Check email authentication via public DNS
The tool looks for SPF at the domain, DMARC at _dmarc and, optionally, a DKIM public key at selector._domainkey. It can help after mail migration, provider changes or setting up newsletters.
What warnings mean
For SPF, we flag multiple policy records, +all, missing final all and many direct lookup terms. RFC 7208 limits the total DNS-causing terms during SPF evaluation to 10; the displayed direct terms are not a full evaluation of nested include and redirect chains.
For DMARC we display the p policy, pct, alignment and aggregate report address when available. p=none is a valid monitoring policy, not a request to quarantine or reject failing email.
Why is a DKIM selector needed?
A DKIM key is bound to a selector, which you can find in your email provider's settings or the s= parameter of the DKIM-Signature header from a sent message. Published DNS records do not guarantee how a specific message was authenticated.
Frequently asked questions
What does the SPF checker inspect?
It finds a public TXT record starting with v=spf1, shows the final all mechanism and direct mechanisms that may trigger DNS queries, and flags multiple SPF records or an obviously unsafe +all.
What does the DMARC checker inspect?
It looks up the TXT record at _dmarc for your domain and shows its p policy, pct percentage, SPF/DKIM alignment and aggregate reporting address when published.
Why is a DKIM selector optional?
The DKIM public key does not have one universal DNS name. A sender uses the selector specified by the mail provider or found in the message's DKIM-Signature header.
Does this prove that my messages pass SPF, DKIM and DMARC?
No. The checker inspects public DNS records and some common mistakes. To know how a specific message was authenticated, also inspect its email headers and the identities used to send it.
How many DNS lookups may SPF use?
RFC 7208 limits SPF terms that cause DNS queries during actual evaluation to 10. Our display counts direct lookup terms in the main record; include and redirect can cause additional queries.
What does p=none mean in DMARC?
It is a monitoring policy. A DMARC record can be valid and generate reports, but p=none does not request quarantine or rejection of messages that fail DMARC.
