SPF and DMARC records for github.com
Live SPF and DMARC lookup for github.com: the raw TXT records and the policy they enforce.
try:
- mail hosts
- github-com.mail.protection.outlook.com
- provider
- microsoft
- spf record
- v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all
- dmarc policy
- quarantine
- dmarc record
- v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
- disposable domain
- no
- free consumer provider
- no
SPF for github.com
github.com publishes an SPF record; it authorises 8 included sender lists, and the record ends in ~all (soft fail): mail from unlisted servers is marked suspicious but usually still delivered.
DMARC for github.com
github.com publishes DMARC with p=quarantine, which tells receivers to sideline mail that fails alignment instead of blocking it. Many domains stay here while they tidy up legitimate senders.
Why it matters
Receivers use SPF, DKIM, and DMARC together to decide whether a message really came from github.com. A domain with a strict SPF record and an enforcing DMARC policy is hard to spoof and easier to deliver for; one without either is neither. Spaw reports has_spf and dmarc_policy on every lookup and adds a small risk weight when SPF is missing.
More checks for github.com
checked 2026-09-03 · sources: live-dns 2026-09-03 · disposable-domains 2026-09-02 · free-provider-domains 2026-09-02 · mx-provider-patterns 2026-09-03 · rdap-registration 2026-09-03 · Top-domain list: Majestic Million, CC BY 3.0
Need this at scale?
The Spaw API runs the same checks plus mailbox-level SMTP verification, batch and bulk endpoints, and list monitoring — 10 free lookups a month, no card required.