SPF DKIM DMARC Checker

Look up the DNS records that stop other people sending mail as you

100% free. This tool needs our server to do the work, so what you submit is sent there, processed and then discarded - it is never stored.

Jump to the next useful tool without leaving your flow.

See more

About this tool

Anyone can put your domain in a From line unless DNS says otherwise. SPF lists who may send, DKIM signs the message, and DMARC says what receivers should do on a fail. This page looks up TXT for the domain (SPF), _dmarc.domain (DMARC), and a handful of common DKIM selectors (google, selector1, selector2, s1, s2, default). A missing guess for DKIM does not mean DKIM is off; it means that selector is unused. Paste example.com, not a mailbox.

How to use this tool

  1. Enter the domainexample.com, not user@example.com.
  2. Check DNSSPF, DMARC and the common DKIM selector names are queried.
  3. Read the recordsCopy a missing DMARC or a too-permissive SPF into your DNS host's docs.

Setting up SPF, DKIM and DMARC

SPF is one TXT record listing the services allowed to send for your domain, such as include:_spf.google.com - there must be only one SPF record. DKIM is a public key published by your email provider under a selector name. DMARC is a TXT record at _dmarc.yourdomain that tells receivers what to do when a message fails.

Start DMARC with p=none and a reporting address to see who sends as you, then move to quarantine and finally reject. Gmail and Yahoo now require SPF, DKIM and DMARC for bulk senders.

Key features

  • SPF, DMARC and typical DKIM selectors in one pass.
  • Honest about DKIM: only guessed selectors, not a brute force of every name.
  • Helps before you send invoices or newsletters from a new domain.

Common uses

  • Checking a new company domain before the first campaign.
  • Seeing why Gmail marked you as unauthenticated.
  • Confirming DMARC exists after a DNS change.

Tips for better results

  • Start DMARC at p=none, watch reports, then quarantine or reject.
  • SPF should end with an all mechanism. +all is "anyone may send".
  • Microsoft 365 often uses selector1 and selector2. Google Workspace often uses google.
  • Pair with the email spam wording checker. Auth and words are different layers.

Mistakes to avoid

  • Pasting a full email address and wondering why lookup failed.
  • Assuming no DKIM on s1 means the domain has no DKIM at all.
  • Publishing SPF +all because it "passes". It passes for spoofers too.

Frequently asked questions

Enter the domain. SPF is the v=spf1 TXT on the apex. DMARC is TXT on _dmarc. DKIM is tried on common selector names; add your provider's selector if none match.

Google's selector is often "google". If that row is empty, the DNS TXT at google._domainkey.yourdomain.com is missing or not yet propagated.

Publishing the records does. This page only reads them. Receivers still decide; p=reject is what tells them to drop fakes.

Yes. DNS lookup, not a mailbox login.