🛡️ SPF, DKIM & DMARC Checker
Check any domain's email authentication records for spoofing protection. We look up SPF, DKIM, and DMARC, explain what each record means, and flag misconfigurations in plain English. No account, nothing stored.
About the SPF, DKIM & DMARC Checker
SPF, DKIM, and DMARC are the three DNS records that stop criminals from sending email that looks like it came from your domain. Together they tell receiving mail servers which servers are allowed to send on your behalf (SPF), cryptographically sign your messages so tampering is detectable (DKIM), and instruct receivers what to do with mail that fails those checks while sending you reports (DMARC). This tool looks up all three for any domain and explains what it finds in plain English.
A missing or misconfigured record is one of the most common reasons legitimate email lands in spam — and one of the easiest ways for attackers to spoof your brand in phishing campaigns. Our checker flags the issues that actually matter: no SPF record, more than one SPF record, a dangerous “+all”, exceeding the ten DNS-lookup limit, a DMARC policy stuck on “p=none”, missing reporting addresses, and revoked DKIM keys.
Enter a domain to get an at-a-glance grade plus a breakdown of each record and how to fix any problems. DKIM selectors are provider-specific and can’t be discovered from DNS alone, so we automatically probe the most common selectors — if you know yours, enter it for a precise result. Nothing is stored and no account is required.
Frequently asked questions
What are SPF, DKIM, and DMARC?
They are DNS records that authenticate your email. SPF lists which servers may send mail for your domain, DKIM adds a cryptographic signature that proves a message wasn't altered, and DMARC tells receivers how to handle mail that fails SPF or DKIM and sends you reports. Used together, they prevent attackers from spoofing your domain.
Why is my DKIM record not found?
DKIM records live at a provider-specific “selector” (selector._domainkey.yourdomain.com) that can't be discovered from DNS alone. We automatically probe the most common selectors, but if none match, enter your selector — you can find it in your email provider's settings or in the DKIM-Signature header of an email you sent.
What is a good DMARC policy?
Start with p=none to monitor without affecting delivery, review the aggregate (rua) reports to confirm your legitimate mail passes, then move to p=quarantine and finally p=reject for the strongest protection. A policy of p=reject with SPF and DKIM aligned means spoofed mail is rejected outright.