SPF, DKIM & DMARC checker
Inspect the DNS records that authorize senders, sign messages, and define spoofing policy.
Try
Review the three authentication layers
SPF, DKIM, and DMARC solve different parts of email authentication. A healthy sending domain normally publishes all three, but DKIM selectors are provider-specific and cannot be discovered exhaustively from DNS alone.
- SPF authorized-sender policy
- Common DKIM selector scan
- DMARC enforcement and reporting policy
- Raw records for configuration review
SPF
Which servers may send
Lists the addresses allowed to send mail as your domain.
DKIM
Was it altered on the way
A signature the receiver verifies against the public key in your DNS.
DMARC
What to do on failure
Tells receivers to accept, quarantine, or reject when the first two fail.
Common questions
- Do I need all three?
- Yes, for any domain that sends mail. SPF and DKIM prove authenticity, DMARC decides what happens when they fail.
- Why was no DKIM record found?
- DKIM sits under a selector name your provider picks, and selectors cannot be listed from DNS. A scan can only try common ones.
- What does p=none mean?
- DMARC is in monitoring mode. Failures get reported but nothing is blocked. Move to quarantine or reject once reports look clean.
- Can I publish two SPF records?
- No. A domain must have exactly one. Two makes SPF fail outright, so merge them into a single record.
- Does passing prove my mail reaches the inbox?
- No. Authentication is one input. Content, reputation, and recipient engagement also decide placement.
Use these checks during signup
The API returns allow, review, or block with the reasons behind it.