SPF, DKIM and DMARC Checker.
Check the email authentication of any domain: who may send for it (SPF), whether mail is signed (DKIM), what receivers should do with fakes (DMARC), and where mail is delivered (MX).
100% free, no sign-up. To stop automated scanning, each browser can run up to 10 scans per tool every 3 hours; only that count is kept (privacy).
What Is an Email Authentication Check?
SPF, DKIM and DMARC are three DNS records that prove email really comes from your domain. SPF lists the servers allowed to send for it. DKIM adds a digital signature to each message that receivers check against a public key in your DNS. DMARC tells receivers what to do when a message fails those checks, and where to send reports.
Without them, anyone can send mail pretending to be you, and large providers such as Gmail, Yahoo and Microsoft are more likely to reject or spam-folder your real mail. Since 2024, bulk senders to Gmail and Yahoo must have all three.
This tool reads your public DNS only. It checks MX, SPF (including how many lookups it uses), the common DKIM selectors, DMARC, MTA-STS and TLS-RPT, and lists what to fix. It does not send any email.
Is Your Email Set Up Properly?
Gmail, Yahoo and Microsoft expect SPF, DKIM and DMARC from senders. The tool reads your DNS and says what is missing or wrong.
Mail servers (MX)
Where mail for the domain is delivered, with priorities.
SPF
The record that lists which servers may send for the domain, how many DNS lookups it uses (the limit is 10) and how it ends.
DKIM
Signing keys found at the most common selector names. Selectors cannot be listed, so the tool says when it cannot tell.
DMARC
The policy (none, quarantine or reject), report addresses, percentage and alignment.
MTA-STS and TLS-RPT
Whether the domain asks other mail servers to use encrypted connections and send reports about failures.
A short fix list
The banner at the top names the problems found, so you know what to change first.
Common Problems and Fixes.
The problems this check finds most often.
There are two SPF records
Only one SPF record is allowed per domain. Merge them into a single line that lists every sender, ending in -all or ~all.
SPF uses more than 10 lookups
Every include, a, mx, ptr and exists counts, including those inside other records. Over 10 makes SPF fail. Remove unused senders or flatten the record.
There is no DMARC record
Publish a TXT record at _dmarc.yourdomain with v=DMARC1; p=none; rua=mailto:an address you read. Watch the reports, then move to quarantine and reject.
DMARC is set to p=none
That only monitors; it blocks nothing. After the reports show your real senders pass, move to p=quarantine and then p=reject.
No DKIM key was found
The tool tests only common selector names. Ask your mail provider for your selector, then check selector._domainkey.yourdomain. If you have none, enable DKIM in your mail provider.
Mail still goes to spam
Authentication is only part of it. Also check the sending IP with the blacklist check and its reverse DNS, and avoid spammy content.
Related Free Tools.
Frequently Asked Questions
Quick answers about this tool.
Need Business Email That Gets Delivered?
Our engineers set up SPF, DKIM and DMARC on your server. Ask us and send your report.