DNS mail records are public declarations. Most domain owners have never read the message they send.
Your SPF, DMARC, DKIM and MX records tell the internet how to handle mail from your domain. What you think is configured and what is published can be different things — and the difference matters when someone spoofs your domain and you assumed the records were right.
The gap between belief and DNS
Most domain owners have SPF and DMARC on their checklist. But the checklist does not tell you what the records say.
SPF records have a ten-lookup limit
An SPF record that includes multiple third-party services can exceed the 10-DNS-lookup limit. When it does, the extra lookups are silently ignored — mail servers stop evaluating the SPF rule partway through. The record is still published, but it is not fully enforced. Most people do not know this until someone checks.
A DMARC record can be monitoring only
The DMARC policy value tells receivers what to do with mail that fails authentication. A policy of p=none means monitoring only — nothing is enforced. Mail that fails authentication is still delivered. Many domain owners believe they are protected when they are simply collecting data.
DKIM selectors are invisible to scanners
DKIM selectors are not discoverable from the outside. A tool that reports "no DKIM" may simply not have known where to look. Mailrecord asks you for the selectors to check and reports what it finds — and says plainly that other selectors may exist.
What you get
Type a domain. Mailrecord reads its published DNS records and tells you what they mean.
MX records
Which servers handle mail for this domain, and their priority order.
SPF record with lookup count
The full SPF record, the number of DNS lookups it requires, and whether that number exceeds the limit of 10. The limit is the finding a checklist cannot give you.
DMARC policy explained
The DMARC policy value and a plain-language explanation of what it means for your domain. p=none is not protection — Mailrecord says so directly.
DKIM selector checks
You name the selectors. Mailrecord checks them and reports what is published. It never guesses selector names and never reports "no DKIM" when it did not know where to look.