Skip to content

SPF, DKIM and DMARC Checker

Check a domain's SPF, DKIM and DMARC records, count SPF lookups and get plain advice on what to fix.

SPF, DKIM and DMARC Checker tool

Loading...

Example

Input: github.com with no DKIM selector

Result: Needs attention. SPF Pass (10 of 10 DNS lookups, ~all). DMARC Pass (p=quarantine, sp=reject, pct=100). DKIM Needs attention: keys at google, selector1, k1, s1 and s2, with selector1 and k1 using 1024-bit RSA keys. MX 0 github-com.mail.protection.outlook.com

Live DNS on 25 September 2026. The SPF record includes 8 other domains. An exists: term in the Salesforce record and a nested include in the SendGrid record bring the total to exactly the limit of 10.

DMARC Tags at a Glance

TagWhat it setsValues
vVersion, must come firstDMARC1
pPolicy for the domainnone, quarantine, reject
spPolicy for subdomainsnone, quarantine, reject
pctShare of failing mail the policy applies to0 to 100 (default 100)
ruaWhere aggregate reports gomailto: addresses
rufWhere failure reports gomailto: addresses
adkimDKIM alignment moder (relaxed, default) or s (strict)
aspfSPF alignment moder (relaxed, default) or s (strict)
foWhen to send failure reports0 (default), 1, d, s

Tags defined in RFC 7489. Only v and p are required.

  1. Enter the domain you send email from, such as example.com.
  2. Optionally add your DKIM selector (the s= value from an email header), or leave it empty to try common ones.
  3. Press Check records.
  4. Read the summary, then the SPF, DMARC and DKIM sections for the record, its parts and any warnings.
  5. Fix the flagged items in your DNS and run the check again.

How SPF, DKIM and DMARC Work Together

This checker reads the three DNS records that prove email from a domain is genuine: SPF, DKIM and DMARC. Enter a domain and it shows each record, explains every part, and gives each one a verdict: Pass, Needs attention or Fail. It also lists the domain's MX (mail server) records.

SPF is a TXT record starting with v=spf1 that lists the servers allowed to send mail for the domain. The tool follows every include: and redirect= to count DNS lookups, because RFC 7208 caps an SPF check at 10. Go past that and receivers treat the record as broken, a permerror, so mail can fail even from approved servers. It also flags two SPF records on one domain, and an ending of +all or ?all, which protects nothing.

DKIM signs each message with a key published at selector._domainkey.yourdomain. The selector can be any name, and DNS offers no way to list them. If you know yours, enter it. Otherwise the tool tries nine common ones, such as google, selector1 and k1. Not finding a key there does not prove DKIM is missing. The s= value in the DKIM-Signature header of an email shows the real selector.

DMARC lives at _dmarc.yourdomain. It tells receivers what to do when neither SPF nor DKIM passes for the domain in the From address: nothing (p=none), send to spam (quarantine) or refuse (reject). The tool explains each tag and warns about p=none, a pct below 100 and a missing rua= report address.

All lookups go from your browser to Google Public DNS over HTTPS, with Cloudflare as a fallback. Only the names being looked up are sent. Results show what is published right now, subject to DNS caching. To check a single record by hand, use the DNS Lookup.

Sources

Frequently Asked Questions

Count what uses lookups: every include, a, mx, ptr, exists and redirect, including those inside included records. Remove services that no longer send mail for you. Replace an a or mx term with the ip4 or ip6 ranges it stands for. If one provider needs several includes, check its docs for a single combined include.
No. RFC 7208 allows one SPF record per domain. With two, receivers return a permanent error and SPF fails for every message. Merge them into one record: keep a single v=spf1 at the start, combine the mechanisms from both, and end with one all term, such as ~all.
Both are fine once every sending service is listed. ~all (soft fail) marks unlisted senders as suspicious, while -all (fail) asks receivers to reject them. With DMARC in place, receivers act on the DMARC policy either way, so many domains keep ~all. Avoid ?all and never use +all.
Open an email sent from your domain and view its original headers. Find the DKIM-Signature header: the s= tag is the selector and d= is the signing domain. For example, s=google means the key is at google._domainkey.yourdomain. Your email provider's DKIM setup page also shows it.
For their 2024 bulk sender rules, yes: domains that send more than 5,000 messages a day to Gmail need a DMARC record, and p=none meets that minimum. But p=none only monitors, so spoofed mail still gets delivered. Read the rua reports, fix any gaps, then move to quarantine and finally reject.

Related Tools

DNS Lookup

Look up A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV and PTR records for any domain, with TTLs and DNSSEC status.

Network Tools

WHOIS Lookup and Domain Age Checker

Find a domain's registrar, registration and expiry dates, age, status and name servers, or who holds an IP range.

Network Tools

Email Normalizer

Normalize email addresses by lowercasing, removing dots and plus aliases for Gmail, and trimming whitespace.

Network Tools

SSL Certificate Checker URL Parser

Check any website SSL/TLS certificate: validity, days until expiry, issuer, SANs, TLS version, and fingerprints.

Security and Encryption

IP Address Info

Detect your public IP address and view geolocation data, ISP details, and network information.

Security and Encryption