SPF, DKIM & DMARC Checker
Test how well a domain is protected against email spoofing. We read its SPF, DKIM, DMARC, MX and BIMI records live, explain every problem and give you the exact DNS records to fix it.
Checked live from our server — no signup Free, no limits
How to use the SPF DMARC DKIM Checker
- Enter a domain name or any email address at that domain.
- Optionally add your DKIM selectors (the s= value in a message's DKIM-Signature header) — common ones are tried automatically.
- Click Check email security and review the SPF, DKIM and DMARC cards.
- Work through "What to fix" and copy the suggested TXT records into your DNS.
Frequently asked questions
What's the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature that proves a message wasn't altered and came from your domain. DMARC tells receivers what to do when a message fails both checks (none, quarantine or reject) and sends you reports about it.
Why does SPF have a 10 DNS lookup limit?
RFC 7208 caps the include, a, mx, ptr, exists and redirect terms at 10 DNS lookups per check to stop SPF being abused for DNS amplification. Go over it and receivers return a permanent error, so SPF fails for all your mail — nested includes count too.
Should I use ~all or -all?
Both are fine once DMARC is in place, because DMARC decides the final outcome. ~all (softfail) is the safer default while you're still discovering senders; -all (fail) is stricter. Never use +all, which lets anyone send as you.
Why wasn't my DKIM key found?
DKIM keys live at selector._domainkey.yourdomain, and the selector can be any name your provider chooses. We try common ones, but if yours is different, open a sent message's headers, find the s= value in DKIM-Signature and enter it.
Is p=none safe to leave in place?
p=none only monitors — spoofed messages are still delivered. Use it for a few weeks to read the rua reports and fix legitimate senders, then move to p=quarantine and finally p=reject. Gmail and Yahoo require at least p=none for bulk senders.
How long do DNS changes take to show up?
Usually minutes, but resolvers can keep the old record until its TTL expires (often 1 hour). Re-run the check after the TTL, or use the DNS propagation checker to watch resolvers worldwide.