The tools

Which one do you need?

Check a record

Start with the combined checker: one submit reads SPF, DKIM and DMARC and says which to fix first. DMARC is the record that decides what receivers do with mail that fails, and the one that asks for the reports naming every sender using your domain.

If a bounce named SPF, the ten-lookup limit is the usual culprit and the SPF checker gives you the count. If it named DKIM, take the selector from the DKIM-Signature: header of a message you actually sent and give it to the DKIM checker.

None of the checkers changes anything. They read public DNS, the same as any mail server does before it decides about your message.

Read a report

The report analyzer reads in the other direction. Paste the aggregate report XML a receiver mailed you, or upload the file, and it shows which of your senders passed the rules you published. Nothing is stored.

Write a record

Give either generator your domain and it reads what you publish today and adds to it. The SPF record generator splices your senders in ahead of the ending and counts the lookups on the result. The DMARC record generator moves the policy and adds a reporting address while every other tag stays exactly as it is. A generated record pasted over a live one is how a domain loses a sender nobody remembered, which is why both merge instead of replacing.

Change a record

The SPF change pre-flight grades a record before you publish it. Give it the domain and the record you intend to publish, and it names the address ranges that would stop being authorised, the include each one came from, and where the lookup count lands.