---
title: SPF & DMARC
description: How UserCheck summarizes a domain's SPF posture and DMARC policy, what each value means, and which values are common.
---

SPF and DMARC are the two records a domain publishes in DNS to control who may send email in its name, and what receiving servers should do when someone else tries. UserCheck condenses each into a single value.

Both fields are returned by the [domain](/docs/api/domain-endpoint) and [email](/docs/api/email-endpoint) endpoints, and are available in Gates as `domain.spf` and `domain.dmarc`.

## SPF

SPF (Sender Policy Framework) is how a domain declares which servers are allowed to send email in its name. Without it, anyone can send mail that appears to come from the domain. `spf` condenses the domain's published record into a single value: how strictly its owner controls who may send as the domain.

| Value | What it means |
|-------|---------------|
| `strict`     | Only the domain's listed servers may send; everything else should be rejected. A deliberate, tightly managed setup. |
| `relaxed`    | The domain lists its senders but asks receivers to be lenient with the rest. The most common posture for properly configured domains. |
| `neutral`    | A record exists but takes no position on who may send. It provides no protection. |
| `permissive` | The record authorizes every server on the Internet to send as the domain, which defeats the point of SPF. Legitimate domains essentially never publish this deliberately. |
| `missing`    | The domain publishes no SPF record. Common for domains that don't send email, and for domains set up with minimal effort. |
| `invalid`    | The record is broken (for example, several conflicting records) and can't be applied. |

A `strict` or `relaxed` posture means someone deliberately configured the domain's email; that's the normal state of an actively managed domain. `missing` or `neutral` doesn't make a domain suspicious on its own; many small and personal domains never set up SPF. It means SPF provides no signal about the domain either way. `permissive` and `invalid` are the outliers, rarely seen on well-run domains.

SPF applies to the exact domain that was checked; subdomains don't inherit their parent's record. The value is `null` when the record hasn't been assessed yet.

## DMARC

DMARC is the policy a domain publishes to fight impersonation: it tells receiving servers what to do with mail that claims to come from the domain but fails authentication. `dmarc` reflects the policy the domain has chosen.

| Value | What it means |
|-------|---------------|
| `reject`     | Impersonated mail should be refused outright. The strictest policy: the domain's email is actively protected. |
| `quarantine` | Impersonated mail should be delivered to spam. An enforced policy, one step softer than `reject`. |
| `none`       | The domain monitors impersonation but asks receivers not to act on it. The most common policy, and often the first step of a gradual rollout. |
| `missing`    | The domain publishes no DMARC policy at all. |
| `invalid`    | A policy exists but is misconfigured and can't be applied. |

An enforced policy (`reject` or `quarantine`) takes deliberate effort to set up, so it's typical of established organizations that care about their email reputation. `none` or `missing` doesn't make a domain suspicious; most of the Internet, including many legitimate businesses, runs without DMARC enforcement. Unlike SPF, a subdomain without its own policy inherits its parent domain's. The value is `null` when the policy hasn't been assessed yet.