The tools

Which one do you need?

Check a record

Start with the combined checker: one submit reads SPF, DKIM and DMARC and says which to fix first. With a DMARC record, you tell receivers what to do with mail that fails, and you get reports that show who sends mail as your domain.

If a bounce named SPF, the ten-lookup limit is the usual culprit and the SPF checker gives you the count. If it named DKIM, take the selector from the DKIM-Signature: header of a message you actually sent and give it to the DKIM checker.

None of the checkers changes anything. They read public DNS, the same as any mail server does before it decides about your message.

Read a report

The report analyzer reads in the other direction. Paste the aggregate report XML a receiver mailed you, or upload the file, and it shows which of your senders passed the rules you published. Nothing is stored.

Write a record

Give either generator your domain and it reads what you publish today and adds to it. The SPF record generator adds your senders before the closing all term and counts the lookups on the result. The DMARC record generator changes the policy and adds a reporting address while every other tag stays exactly as it is. A generated record pasted over a live one is how a domain loses a forgotten sender, which is why both merge instead of replacing.

Change a record

The SPF change pre-flight grades a record before you publish it. Give it the domain and the record you intend to publish, and it names the address ranges that would stop being authorized, the include each one came from, and where the lookup count lands.