Free tool
SPF & DMARC checker
Can strangers send mail as your domain? This analyzer reads your SPF and DMARC records, follows the SPF include chain to count DNS lookups against the limit of 10, and grades the policy that receivers actually enforce.
This tool runs entirely in your browser: DNS questions go straight to Cloudflare's (or Google's) public DNS-over-HTTPS resolver, and nothing you type here reaches Bastion's servers. Only passive, public DNS data is read — the tool never connects to the domain being checked.
The failure mode nobody notices
Email authentication rarely breaks loudly. The two quiet failures this tool is built
around: an SPF record that drifts past ten DNS lookups as vendors accumulate — at which
point receivers void it with a permerror while your mail keeps flowing — and a DMARC
policy parked at p=none for years, faithfully reporting spoofing that
nothing ever blocks.
Both look fine from the inside. Deliverability doesn't visibly change; no alert fires. What changes is that phishing sent in your name starts passing, or at least stops being rejected — and the first person to find out is usually a customer.
Questions
What do SPF and DMARC actually do?
SPF publishes which servers may send mail for your domain; DKIM signs the mail cryptographically; DMARC is what ties either result to the From: address people actually see, and tells receivers what to do when it fails — nothing, spam folder, or reject. Without DMARC, passing or failing SPF changes very little for a spoofer.
What is the SPF 10-lookup limit?
RFC 7208 caps an SPF check at 10 DNS-querying mechanisms — include, a, mx, ptr, exists and redirect — counted through every nested include. Go over and receivers return a permerror, which voids your SPF entirely. It fails silently: mail keeps flowing, protection stops. This tool counts the chain recursively so you can see how close you are.
Is p=none good enough?
As a starting point, yes — it turns on reporting without risking legitimate mail. As a destination, no: spoofed mail is still delivered. The intended path is p=none to collect reports, p=quarantine once they're clean, p=reject as the end state.
Why did my SPF break when we added a new email vendor?
Almost always the lookup limit: each vendor's include brings its own nested includes, and the tenth lookup is crossed without anyone touching the record's visible text. This is why SPF deserves monitoring rather than an annual audit — a record can go from valid to permerror because a vendor restructured their DNS.
Checked once. Now have it watched.
Bastion checks SPF, DMARC and the rest of your DNS posture on every scan, and — because records drift — alerts you specifically when email authentication weakens: a policy relaxed, a record dropped, an include chain gone over the limit.
7-day trial of the full product, no card required. Scanning needs domain ownership verified by DNS — Bastion never scans anything you haven't proved you control.