Skip to content
dnsdon
Get Pro free
Tools/SPF, DKIM & DMARC Checker

SPF, DKIM & DMARC Checker

Check SPF, DKIM and DMARC: the records inboxes use to decide whether your mail is genuine, and whether they are strict enough to stop spoofing.

Enter a domain or hostname. Pasted URLs and internationalized names work too.

DKIM selector is optional. Find it as s= in the DKIM-Signature header of a sent message. Up to 5, separated by commas. Leave empty to try common ones.

What this tool checks

  • MX records, including "null MX" for domains that receive no mail
  • SPF syntax, default policy and the 10-lookup limit, following every include
  • DMARC policy, enforcement level and report authorization
  • DKIM keys at your selector, with key length
  • MTA-STS: the policy file, its certificate and whether it covers every MX
  • TLS-RPT reporting, and the BIMI logo file and its DMARC requirement
  • Reverse DNS (PTR) for each mail server

How to read the results

Pass
The check succeeded based on the observed responses.
Warning
Works now, but is risky, unusual or worth reviewing.
Fail
A problem was observed directly in the responses.
Inconclusive
Not enough evidence — for example a server did not respond.

Frequently asked questions

How do I check my DMARC record?
Enter your domain above. The checker reads the TXT record at _dmarc.yourdomain, explains the policy (none, quarantine or reject), checks the reporting addresses and tells you whether the policy is strict enough to stop spoofing.
How do I know if my SPF record is valid?
Enter your domain. The checker parses the SPF record, follows every include, counts DNS lookups against the limit of 10, and flags syntax errors, duplicate SPF records and a weak default policy.
How do I check my DKIM record?
Enter your domain and DKIM selector, found in the s= value of a sent message's DKIM-Signature header. Without a selector, the checker tries common ones such as google, selector1 and selector2.
What do Gmail and Yahoo require from senders?
Bulk senders (around 5,000 messages a day or more) must pass SPF and DKIM, publish a DMARC record of at least p=none and align with the From domain. Every sender needs SPF or DKIM and valid reverse DNS.

Try an example

python.orgDMARC p=none: spoofed mail still delivered google.comStrict DMARC (p=reject) github.comMany SPF includes example.comNull MX: sends and receives no mail

Related guides

SPF, DKIM and DMARC Explained (Gmail & Yahoo Rules) 9 min How to Find Your DKIM Selector and Check the Record 6 min SPF PermError: Too Many DNS Lookups (How to Fix) 6 min Why Are My Emails Going to Spam? How to Find and Fix It 7 min DMARC p=none to p=reject: A Safe Rollout Plan 7 min How to Set Up BIMI: Free vs VMC & CMC Logos 8 min