SPF & DMARC

SPF and DMARC are the two records a domain publishes in DNS to control who may send email in its name, and what receiving servers should do when someone else tries. UserCheck condenses each into a single value.

Both fields are returned by the domain and email endpoints, and are available in Gates as domain.spf and domain.dmarc.

SPF

SPF (Sender Policy Framework) is how a domain declares which servers are allowed to send email in its name. Without it, anyone can send mail that appears to come from the domain. spf condenses the domain's published record into a single value: how strictly its owner controls who may send as the domain.

Value	What it means
strict	Only the domain's listed servers may send; everything else should be rejected. A deliberate, tightly managed setup.
relaxed	The domain lists its senders but asks receivers to be lenient with the rest. The most common posture for properly configured domains.
neutral	A record exists but takes no position on who may send. It provides no protection.
permissive	The record authorizes every server on the Internet to send as the domain, which defeats the point of SPF. Legitimate domains essentially never publish this deliberately.
missing	The domain publishes no SPF record. Common for domains that don't send email, and for domains set up with minimal effort.
invalid	The record is broken (for example, several conflicting records) and can't be applied.

A strict or relaxed posture means someone deliberately configured the domain's email; that's the normal state of an actively managed domain. missing or neutral doesn't make a domain suspicious on its own; many small and personal domains never set up SPF. It means SPF provides no signal about the domain either way. permissive and invalid are the outliers, rarely seen on well-run domains.

SPF applies to the exact domain that was checked; subdomains don't inherit their parent's record. The value is null when the record hasn't been assessed yet.

DMARC

DMARC is the policy a domain publishes to fight impersonation: it tells receiving servers what to do with mail that claims to come from the domain but fails authentication. dmarc reflects the policy the domain has chosen.

Value	What it means
reject	Impersonated mail should be refused outright. The strictest policy: the domain's email is actively protected.
quarantine	Impersonated mail should be delivered to spam. An enforced policy, one step softer than reject.
none	The domain monitors impersonation but asks receivers not to act on it. The most common policy, and often the first step of a gradual rollout.
missing	The domain publishes no DMARC policy at all.
invalid	A policy exists but is misconfigured and can't be applied.

An enforced policy (reject or quarantine) takes deliberate effort to set up, so it's typical of established organizations that care about their email reputation. none or missing doesn't make a domain suspicious; most of the Internet, including many legitimate businesses, runs without DMARC enforcement. Unlike SPF, a subdomain without its own policy inherits its parent domain's. The value is null when the policy hasn't been assessed yet.