Check a domain's SPF, DKIM and DMARC
Three DNS records decide whether your email lands in the inbox or the spam folder. This tool reads them live: who may write in your name (SPF), how your messages are signed (DKIM), and what you ask recipients to do with impostors (DMARC).
A domain, a URL or an email address — the domain is extracted from it.
enHow the check works
- 1
MX records are read
They name the servers that receive the domain's mail. Their absence means the domain is not configured to receive — the leading cause of hard bounces.
- 2
SPF is analysed, not just displayed
We count the mechanisms that trigger a DNS lookup (the RFC allows ten, not one more), read the 'all' qualifier, and flag duplicates — two SPF records make the whole check fail.
- 3
DMARC and DKIM complete the picture
The DMARC policy is read with its percentage and report addresses. On the DKIM side, about twenty common selectors are probed.
The three records do different jobs
SPF declares which servers may send for your domain. DKIM cryptographically signs each message, proving it was not altered in transit. DMARC is the instruction: what should the recipient do when neither SPF nor DKIM aligns with the domain shown on screen.
Publishing SPF and DKIM without DMARC leaves the recipient to decide alone. Publishing DMARC at p=none observes without protecting. The setup that actually protects is p=quarantine or p=reject, once the reports check out.
What the tool cannot see
A missing DKIM selector proves nothing: a domain signing with a custom selector will not appear in the probed list. That is a limitation of DKIM, not of the tool.
Your sending IP's reputation, your presence on a blocklist and your message content weigh heavily on deliverability and cannot be read from DNS.
Frequently asked questions
Do I need all three, or is one enough?
All three. Since 2024, Gmail and Yahoo require SPF or DKIM from every sender, and all three from anyone sending over 5,000 messages a day to their users. A domain without DMARC increasingly sees legitimate mail filtered.
Why does my SPF fail when it looks correct?
The most common cause is the ten-DNS-lookup limit. Every 'include:' consumes one, and an include can contain more: three email providers are enough to blow past the cap. Beyond it, the check returns a permanent error, exactly as if no SPF existed.
What does ~all mean and should I move to -all?
The tilde asks recipients to mark non-compliant messages without rejecting them; the dash asks them to reject. Move to the dash once your DMARC reports confirm no legitimate sending fails — otherwise you will cut off your own invoices or application notifications.
Do these queries go through your servers?
No. They leave your browser for Google's and Cloudflare's public resolvers over DNS-over-HTTPS. We do not see the domains you test, and the quota consumed is your connection's — which is what lets the tool stay free and account-free.
The same check over API
This tool runs in your browser. To run the same check from your code, in bulk or server-side, the API answers in JSON.
Read the documentation