SPF, DKIM & DMARC Checker
Check a domain's email-authentication records — SPF, DKIM, DMARC and MX — live from public DNS, with a clear verdict on whether it's protected against spoofing. Free, nothing stored.
How email authentication works
Three DNS records work together to stop criminals sending email that looks like it came from a
domain. SPF (a TXT record) lists the servers allowed to send mail for the domain.
DKIM publishes a public key so each message can carry a verifiable signature.
DMARC (a TXT record at _dmarc) tells receiving servers what to do when
SPF or DKIM fail — monitor only (p=none), send to spam (p=quarantine) or
reject outright (p=reject) — and where to send aggregate reports. Getting all three
right is what earns a domain a strong sending reputation and keeps spoofed mail out of inboxes.
What a healthy domain should have
| Record | Recommended |
|---|---|
SPF | One v=spf1 record that ends in -all (hard fail) or ~all (soft fail). |
DKIM | A key published at your provider's selector, e.g. google._domainkey, selector1._domainkey. |
DMARC | v=DMARC1; p=quarantine (or p=reject) with an rua= reporting address. |
MX | At least one mail server, needed to receive email and to validate SPF alignment. |
More PAYATE tools
Frequently asked questions
What are SPF, DKIM and DMARC?
They are the three DNS records that protect a domain from email spoofing. SPF lists which servers may send mail for the domain; DKIM adds a cryptographic signature to each message; DMARC tells receivers what to do when SPF/DKIM fail (none, quarantine or reject) and where to send reports.
Why is my DKIM "not found"?
DKIM records live at <selector>._domainkey.yourdomain, and the selector is chosen by your mail provider. We probe the most common selectors automatically, but if yours is custom, enter it in the selector box and check again.
What does a good setup look like?
An SPF record ending in -all (or ~all), a DKIM key published for your sending selector, and a DMARC record with at least p=quarantine or p=reject plus an rua= reporting address.
Does this tool send any email?
No. It only reads the public DNS records for the domain you enter and nothing is stored. To see all of a domain's records use the DNS Lookup.