Perform live DNS-over-HTTPS (DoH) queries, inspect A, MX, TXT, and CAA records, or construct valid SPF, DMARC, and DKIM email security policies 100% in browser.
{{ lookupError }}
Select your mail service to generate the complete, production-ready DNS configuration (MX servers with priorities, SPF records, DKIM selectors, DMARC policy, and domain verification tokens) customized for your domain.
Follows the domain's live SPF record through every include:/redirect= it finds (via {{ resolverLabel }} DoH — same resolver selected on the Lookup tab), counting toward RFC 7208's hard limit of {{ spfLookupLimit }} DNS-lookup mechanisms (include/a/mx/ptr/exists/redirect) and flagging include cycles. Checks the domain's live, published record, not the one being edited above.
{{ spfChainError }}
Over budget — RFC 7208 §4.6.4 requires a "permerror" (hard SPF failure) once more than {{ spfLookupLimit }} lookup-causing mechanisms are evaluated. Everything flagged below would never actually be reached by a real mail server.
Scope: include/redirect chains are fully followed since they reference another domain's own SPF policy. Bare a/mx/ptr/exists mechanisms are counted toward the budget as leaves but not expanded further — they check addresses, not another domain's SPF record. The per-mx-record sub-limit of 10 address lookups (RFC 7208 §4.6.4) is not modeled.
Real WHOIS domain-registration lookup (registrar, creation/expiry dates, name servers) via the actual WHOIS protocol (port 43) — not a hardcoded per-TLD table, but a live referral chain through IANA, the TLD registry, and (when needed) the sponsoring registrar. Browsers can't open a raw TCP socket, so this is the only feature on this page that goes through this site's own backend, protected by Cloudflare Turnstile and rate-limited.
{{ whoisError }}
{{ whoisResult.raw }}Showing {{ visibleRecords.length }} of {{ records.length }} records. Copy/Download includes all.
{{ rec.parseError }}; raw data preserved.
These four recursive resolvers are not a worldwide propagation test. Cache age, GeoDNS/ECS and resolver policy can cause differences. TTL is excluded from comparison. Quad9 and Control D use unfiltered services. Quad9 uses its ECS variant, which can forward approximate client location to authoritative DNS servers. AD is the resolver-reported flag, not an independent DNSSEC verification.
Answers differ. This does not by itself prove incomplete DNS propagation.
| Query | {{ group.label }} | Comparison |
|---|---|---|
| {{ summary.type }} | {{ cell.state }} · {{ cell.count }} records · AD — {{ cell.error }} | {{ summary.different ? 'Different answers' : summary.complete ? 'Same answers' : 'Incomplete' }} |
Showing 300 of {{ group.records.length }}. Export includes all.
{{ query.type }}: {{ query.state }} — {{ query.error }}
{{ rec.parseError }}; raw data preserved.
{{ spfRecord }}{{ dmarcRecord }}{{ dkimRecord }}A found TXT record that looks like SPF, DMARC or DKIM gets an "Edit in ... Builder" button that loads it straight into the matching tab instead of retyping it by hand. The Lookup tab can also query Cloudflare and Google DoH side by side, flagging any record where the two disagree. The SPF Builder's live chain check follows a domain's real include:/redirect= chain via live lookups and counts them against RFC 7208's hard limit of 10 DNS-lookup mechanisms — exceeding it is a "permerror" that silently breaks SPF for the whole domain, and is one of the most common real-world SPF misconfigurations, usually from stacking too many mail providers' include: statements.
Privacy: DNS lookups use DNS-over-HTTPS (DoH) through public secure resolvers (Cloudflare, Google, unfiltered Quad9 (ECS variant) and unfiltered Control D) queried live directly from your browser — the domain you look up goes straight to that resolver, never through this site's own server. WHOIS is different: browsers cannot open a raw TCP socket, so the WHOIS tab (opt-in, gated by Cloudflare Turnstile) sends the domain to this site's own backend, which performs the real WHOIS query (IANA → registry → registrar) server-side and returns the result. Nothing from a WHOIS lookup is stored beyond a rate-limit counter keyed to a hash of your IP.
