SPF, DKIM and DMARC Checker
Check a domain's SPF, DKIM and DMARC records, count SPF lookups and get plain advice on what to fix.
SPF, DKIM and DMARC Checker tool
Example
Input: github.com with no DKIM selector
Result: Needs attention. SPF Pass (10 of 10 DNS lookups, ~all). DMARC Pass (p=quarantine, sp=reject, pct=100). DKIM Needs attention: keys at google, selector1, k1, s1 and s2, with selector1 and k1 using 1024-bit RSA keys. MX 0 github-com.mail.protection.outlook.com
Live DNS on 25 September 2026. The SPF record includes 8 other domains. An exists: term in the Salesforce record and a nested include in the SendGrid record bring the total to exactly the limit of 10.
DMARC Tags at a Glance
| Tag | What it sets | Values |
|---|---|---|
| v | Version, must come first | DMARC1 |
| p | Policy for the domain | none, quarantine, reject |
| sp | Policy for subdomains | none, quarantine, reject |
| pct | Share of failing mail the policy applies to | 0 to 100 (default 100) |
| rua | Where aggregate reports go | mailto: addresses |
| ruf | Where failure reports go | mailto: addresses |
| adkim | DKIM alignment mode | r (relaxed, default) or s (strict) |
| aspf | SPF alignment mode | r (relaxed, default) or s (strict) |
| fo | When to send failure reports | 0 (default), 1, d, s |
Tags defined in RFC 7489. Only v and p are required.
- Enter the domain you send email from, such as example.com.
- Optionally add your DKIM selector (the s= value from an email header), or leave it empty to try common ones.
- Press Check records.
- Read the summary, then the SPF, DMARC and DKIM sections for the record, its parts and any warnings.
- Fix the flagged items in your DNS and run the check again.
How SPF, DKIM and DMARC Work Together
This checker reads the three DNS records that prove email from a domain is genuine: SPF, DKIM and DMARC. Enter a domain and it shows each record, explains every part, and gives each one a verdict: Pass, Needs attention or Fail. It also lists the domain's MX (mail server) records.
SPF is a TXT record starting with v=spf1 that lists the servers allowed to send mail for the domain. The tool follows every include: and redirect= to count DNS lookups, because RFC 7208 caps an SPF check at 10. Go past that and receivers treat the record as broken, a permerror, so mail can fail even from approved servers. It also flags two SPF records on one domain, and an ending of +all or ?all, which protects nothing.
DKIM signs each message with a key published at selector._domainkey.yourdomain. The selector can be any name, and DNS offers no way to list them. If you know yours, enter it. Otherwise the tool tries nine common ones, such as google, selector1 and k1. Not finding a key there does not prove DKIM is missing. The s= value in the DKIM-Signature header of an email shows the real selector.
DMARC lives at _dmarc.yourdomain. It tells receivers what to do when neither SPF nor DKIM passes for the domain in the From address: nothing (p=none), send to spam (quarantine) or refuse (reject). The tool explains each tag and warns about p=none, a pct below 100 and a missing rua= report address.
All lookups go from your browser to Google Public DNS over HTTPS, with Cloudflare as a fallback. Only the names being looked up are sent. Results show what is published right now, subject to DNS caching. To check a single record by hand, use the DNS Lookup.
Sources
Frequently Asked Questions
Related Tools
DNS Lookup
Look up A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV and PTR records for any domain, with TTLs and DNSSEC status.
Network ToolsWHOIS Lookup and Domain Age Checker
Find a domain's registrar, registration and expiry dates, age, status and name servers, or who holds an IP range.
Network ToolsEmail Normalizer
Normalize email addresses by lowercasing, removing dots and plus aliases for Gmail, and trimming whitespace.
Network Tools