Domain & website
SPF, DKIM and DMARC checker
Check a domain email authentication setup: MX records, SPF, DKIM, DMARC and MTA-STS.
Every query goes directly from your browser to Cloudflare DNS-over-HTTPS.
What is SPF, DKIM and DMARC checker?
Email was designed before anyone worried about fraud, so by default anybody can send mail claiming to be your domain. Three DNS records exist to close that hole: SPF declares which servers may send on your behalf, DKIM signs each message cryptographically, and DMARC tells receiving servers what to do when a message fails both of those checks.
This tool queries all five at once, MX, SPF, DKIM, DMARC and MTA-STS, and points out what is missing. Where it goes further than most checkers is in counting the DNS lookups your SPF record costs, following nested includes as it goes. The specification allows ten; exceed that and the whole record is treated as broken and mail gets rejected, with no warning anywhere, and you cannot count them by eye because includes nest several levels deep.
DKIM has one limitation worth knowing: there is no way to enumerate the selectors in use, you have to guess the name correctly. This tool tries the common selectors used by Google Workspace, Microsoft 365, Zoho and several bulk senders. Finding nothing does not mean DKIM is unconfigured, only that your selector is not on that list.
The whole tool runs in your browser: queries go straight to Cloudflare DNS-over-HTTPS, and this site server neither participates nor sees the domain you looked up.
How to use
- Enter the domain part of your email address, the part after the at sign, for example example.com.
- If you know your DKIM selector, put it in the second field, otherwise leave it blank.
- Read the DMARC block first: no record means there is no real protection in place.
- Check the DNS lookup count in the SPF block, it must be ten or fewer.
- To find your DKIM selector, open a message sent from this domain and read the DKIM-Signature line in its headers.
Frequently asked questions
Where should I start if I have nothing set up?
In the order SPF, DKIM, then DMARC. SPF first because it is the simplest, usually a single line your email provider already documents. DKIM is generally a switch in an admin panel plus the record they hand you. DMARC comes last, starting with a policy of none so you can observe before tightening.
Why should DMARC not stay at none forever?
The none policy only requests reports, it does not ask receivers to do anything about forged mail. It is useful for the first few weeks while you discover every source sending as your domain. After that, move through quarantine to reject, otherwise your domain remains just as spoofable as before.
My SPF record exceeds ten lookups. How do I fix it?
The most effective fix is removing includes you no longer use, and there are usually several left over from services abandoned long ago. If it is still over after that, replace some includes with direct ip4 ranges, because address ranges cost no lookups at all.
Does no DKIM found mean DKIM is off?
Not necessarily. Selectors cannot be enumerated, so this tool only tries common ones. To be certain, open a message sent from your domain, look at its headers, and find the DKIM-Signature line, which names the selector in use.