SPF, DKIM and DMARC Checker: Email Authentication Test

How to use it

Enter your sending domain. The domain in your From address, like yourcompany.com.
Add a DKIM selector if you know it. Optional. We try 12 common selectors either way.
Check. We read SPF, DKIM, DMARC, MX and BIMI records over DNS.
Fix what fails. Each problem comes with the record or change that fixes it.

Why email authentication matters

Since 2024, Gmail and Yahoo require bulk senders to authenticate their mail, and every major provider uses these records to decide between the inbox, the spam folder and outright rejection. They also stop strangers sending phishing in your name. For a startup, that means signup confirmations, password resets and launch emails reaching people.

The three records

SPF (a TXT record on your domain) lists the servers allowed to send as you: v=spf1 include:_spf.google.com include:sendgrid.net ~all. Keep to one SPF record, and keep it under 10 DNS lookups. Each include, a, mx and redirect costs one, and so do the includes inside them. Over 10, SPF fails for everyone.
DKIM signs each message with a key published at selector._domainkey.yourdomain.com. Your email provider gives you the record. Use 2048-bit keys where you can.
DMARC (a TXT record at _dmarc.yourdomain.com) tells receivers what to do when a message fails SPF and DKIM alignment, and where to send reports: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.

A safe rollout

Publish SPF and turn on DKIM with every service that sends for you: your mailbox provider, newsletter tool, transactional email and CRM.
Add DMARC with p=none and a rua address. Read the reports for two to four weeks to find senders you forgot.
Move to p=quarantine, then p=reject once legitimate mail passes.

Domains that never send mail

Lock them down so nobody can spoof them: v=spf1 -all and v=DMARC1; p=reject.

BIMI is the optional last step. It shows your logo next to messages in Gmail and Apple Mail, and needs DMARC at quarantine or reject first.

See every raw record with the DNS lookup.

What you get

SPF record, all qualifier and lookup count
DKIM at 12 common selectors plus your own
DMARC policy and reporting address
MX and null MX detection
BIMI record check

Questions

How do I check my SPF, DKIM and DMARC records?

Enter your sending domain above. We read the SPF TXT record, try common DKIM selectors (and yours, if you enter it), read the DMARC record at _dmarc, and explain each result.

Why is my DKIM record not found?

DKIM records live under a selector your email provider chooses. If yours is not one of the common ones, find it in the s= value of the DKIM-Signature header in an email you sent, and enter it in the selector field.

What does the SPF 10 lookup limit mean?

Receivers stop evaluating SPF after 10 DNS lookups, and the check fails. Every include, a, mx, exists and redirect counts, including those inside included records. Remove services you no longer use, or flatten includes into ip4 ranges.

Should DMARC be p=none, quarantine or reject?

Start at p=none with reporting to see who sends as you. Move to quarantine, then reject, once your legitimate mail passes. p=none alone does not stop spoofing.

What is the difference between ~all and -all in SPF?

~all (soft fail) marks unlisted senders as suspicious, -all (hard fail) says they are not allowed. With DMARC in place, either works. +all lets anyone send as you and should never be used.