DNS Lookup

Q: What should a healthy email-auth setup look like?

One SPF TXT record ending in ~all or -all, and a DMARC record at _dmarc with p=quarantine or p=reject once you trust your mail flows. p=none is monitoring-only — fine to start, not a destination.

Records resolved via DNS-over-HTTPS (1.1.1.1), with one-click SPF/DMARC email-auth checks.

How it works

Queries go to Cloudflare's public resolver over DNS-over-HTTPS and results are shown verbatim — record data and TTLs exactly as the resolver returned them. The SPF + DMARC button runs two TXT queries (yourdomain and _dmarc.yourdomain) and flags missing or obviously weak policies (p=none, +all).

FAQ

What should a healthy email-auth setup look like?

One SPF TXT record ending in ~all or -all, and a DMARC record at _dmarc with p=quarantine or p=reject once you trust your mail flows. p=none is monitoring-only — fine to start, not a destination.

Why do I see different answers than my local dig?

Caching and resolver location. This tool asks 1.1.1.1 from Cloudflare's edge; your local resolver may hold an older cached answer.

From the channel

Video thumbnail: An AI Hacked a Whole Company With Nobody Watching

An AI Hacked a Whole Company With Nobody Watching Watch safe, hands-on security demonstrations for complete beginners on The Exploit HQ ▸