SPF, DKIM and DMARC Checker
Check a domain’s email authentication in one go. See its SPF record and DNS lookup count, find its DKIM keys and read its DMARC policy, each with a plain verdict and what to fix. Free, and no signup.
Check a domain
Enter the domain from the From: address of your mail. The records are read live from public DNS.
Enter a domain and press Check.
Nothing checked yet.
Lookups go straight from your browser to Google Public DNS over HTTPS. Nothing is sent to our servers, logged or saved.
Three DNS records decide whether your mail is trusted. SPF lists the servers allowed to send for your domain, DKIM publishes the key that verifies each message’s signature, and DMARC tells receivers what to do when both fail and where to send reports. A gap in any of them is the usual reason mail lands in spam or a domain gets spoofed. This tool reads all three and explains each result.
Key benefits
Common use cases
How to use it
- 1.Enter the domain. Type the domain from your From: address, such as
example.com. A full email address or URL works too; the domain is extracted. - 2.Add a DKIM selector if you know it. Leave the box empty to try common selectors. Your real selector is the
s=value in the DKIM-Signature header of a message you sent. - 3.Press Check domain. SPF, DKIM and DMARC are looked up in parallel. Each gets a verdict and a list of clear, actionable findings.
- 4.Fix and re-check. Change the record at your DNS host, then check again. DNS changes can take up to the record’s TTL to show.
What each record does
They work together. SPF and DKIM prove a message is genuine; DMARC ties them to the visible From: domain and sets the policy.
ip4:, include: and similar terms, and ends with ~all or -all. There must be exactly one.include, a, mx, exists and redirect costs a DNS lookup, counted through nested includes. More than 10 is a permanent error.p= means the key has been revoked._dmarc. plus the domain. Its p= tag is the policy: none, quarantine or reject.Key features
- Checks SPF, DKIM and DMARC together and gives each a verdict
- Follows SPF includes and redirects to count DNS lookups against the limit of 10
- Flags +all, ?all, a missing all, ptr and duplicate SPF records
- Tries 17 common DKIM selectors, or the ones you enter, and estimates key size
- Reads the DMARC policy, subdomain policy, pct and report addresses
- Accepts a domain, an email address or a URL
- Lookups use Google Public DNS over HTTPS, straight from your browser
Passing here does not guarantee the inbox
These records prove who sent a message. Receivers also weigh sender reputation, content, complaint rates and volume, so a domain with perfect SPF, DKIM and DMARC can still land in spam, and a fix may take a few days to show in delivery.
Roll DMARC out in stages: start with p=none and a rua address, read the reports until every real sender passes, then move to quarantine and finally reject. Our guide to reading a DMARC report shows what to look for, and the DNS lookup tool shows any other record type.
Frequently asked questions
What is the difference between SPF, DKIM and DMARC?⌄
SPF lists the servers allowed to send mail for a domain. DKIM adds a cryptographic signature to each message, verified with a public key published in DNS. DMARC requires that SPF or DKIM passes for the domain in the visible From: address, tells receivers what to do when they do not, and asks them to send you reports. You need all three.
Why does the checker say no DKIM key was found?⌄
DKIM keys live at selector._domainkey.yourdomain, and the selector is chosen by the service that signs your mail, so it cannot be discovered from DNS. The checker tries common selectors. If yours is different, find s= in the DKIM-Signature header of a message you sent and enter it in the selector box.
What does "too many DNS lookups" mean for SPF?⌄
SPF allows at most 10 DNS lookups while it is evaluated, counting every include, a, mx, exists and redirect, including those inside included records. Above 10 the result is a permanent error and SPF fails for every message. Remove services you no longer use, or replace includes with the ip4 and ip6 ranges they resolve to.
Should I use ~all or -all?⌄
Both are fine once DMARC is in place, because DMARC decides the outcome. ~all (softfail) is the safer default while you are still discovering every service that sends for you. -all (fail) is stricter. Never use +all, which authorises the whole internet.
Is p=none good enough for DMARC?⌄
It is the right place to start, not to stay. p=none only monitors: mail that fails is still delivered, so spoofing is not stopped. Once your reports show every legitimate sender passing, move to p=quarantine and then p=reject. Google and Yahoo require at least a DMARC record for bulk senders.