About the SPF, DKIM & DMARC Checker
This tool checks the DNS records that decide whether mail from a domain is trusted. It looks up the MX records, parses the SPF record (mechanisms, the all qualifier and total DNS lookups across nested includes), reads the DMARC policy at _dmarc.<domain>, and, if you give a selector, fetches the DKIM key at <selector>._domainkey.<domain> and estimates its size.
It flags the mistakes that break authentication: no SPF record or more than one, +all or ?all, more than 10 DNS lookups (a permanent error under RFC 7208), a missing DMARC record or p=none, and a revoked or weak DKIM key. The score out of 100 weights SPF and DMARC at 30 points each and MX and DKIM at 20 each; a warning earns half. Without a selector, DKIM is skipped and the score is scaled from the other three.
How to use it
- Enter a domain, or an email address; the part after
@is used. - Optionally enter a DKIM selector: the
s=value in theDKIM-Signatureheader of a message the domain sent. - Select Check email.
Examples
- Check example.com: a domain that sends no mail, with a null MX,
v=spf1 -allandp=reject. - Check github.com with the google selector: SPF includes, DMARC and a DKIM key.
Common questions
What does SPF ~all mean?
~all is a softfail: mail from servers not listed should be treated as suspicious but not rejected outright. It is fine alongside an enforcing DMARC policy.
Is DMARC p=none enough?
No. p=none only collects reports and spoofed mail is still delivered. Move to p=quarantine or p=reject once your reports show legitimate mail passing.
How do I find my DKIM selector?
Open the full headers of an email the domain sent and find the DKIM-Signature header; the selector is its s= tag. Common values include google and selector1.
Related tools
- DNS Lookup: see all TXT and MX records for the domain.
- DNS Propagation Checker: confirm a new SPF or DMARC record is visible on public resolvers.