Free SPF, DKIM & DMARC Checker

Is your email authenticated, or easy to spoof?

Enter a domain to check its SPF, DKIM and DMARC records in real time: DNS lookup counts, policy strength, key size, reporting and misconfigurations that send your mail to spam. Free, no signup.

Free plan · Live DNS lookups, no cached data

Enter a domain

Domain name

DKIM selector (optional)

We query the domain's DNS in real time and read the actual records. Your selector is in the DKIM-Signature header of any email you send: look for s=.

DKIM selectors can't be listed from DNS. Without one, we probe common names (default, google, selector1…), and a miss doesn't prove DKIM is absent. DNS records also can't show whether a given sender actually signs its mail correctly.

Looking up SPF, DKIM and DMARC records…

Results for

Email authentication score

out of 100

SPF

DKIM

DMARC

What to fix, in priority order

Email set up. What about your website?

Authentication protects your sender reputation. Run the free website audit to check the SEO and technical health of your pages too.

Run Free Website Audit

About the SPF, DKIM & DMARC Checker

Three DNS records decide whether receiving mail servers trust email sent from your domain. SPF lists the servers allowed to send for you. DKIM adds a cryptographic signature that proves a message wasn't altered and really came from your domain. DMARC ties the two to the address people actually see in the From line, and tells receivers what to do when a message fails: nothing, send it to spam, or reject it. Gmail and Yahoo now expect all three from anyone sending in volume, and a missing or broken record is one of the most common reasons legitimate mail lands in spam.

This tool queries your domain's DNS live and reads the real records. For SPF it follows every include: and redirect= to count the true number of DNS lookups against the limit of 10 (going over it silently breaks SPF), and flags duplicate records, broken includes, loops, the deprecated ptr mechanism and weak all qualifiers. For DMARC it validates every tag, rates the policy, checks subdomain coverage and confirms external report addresses are authorized. For DKIM it reads the selector's public key and measures its real bit length.

A passing result means your DNS is configured correctly. It can't prove every service that sends as your domain is signing its mail, which is why the DMARC reports it asks you to collect are worth reading before you move to a reject policy.