SPF, DKIM & DMARC Checker

Enter a domain or an email address to see whether its mail is protected against spoofing. The tool reads the SPF, DMARC and DKIM records through Google Public DNS, follows every SPF include to count DNS lookups, checks that external DMARC report addresses are authorised, measures DKIM key sizes and turns the findings into a grade with specific fixes.

Uses a third-party API Security Free · no signup

Network notice: DNS lookups are sent to dns.google (Google Public DNS over HTTPS). Only DNS names are sent: the domain you enter, names built from it such as _dmarc.<domain> and <selector>._domainkey.<domain>, and the names its own records point to (SPF includes and DMARC report domains). If you paste an email address, only the part after @ is used; the rest never leaves this page.

How to use

Type a domain such as example.com. An email address or a website URL works too; the tool keeps only the domain.
If you know your DKIM selector (the s= value in the DKIM-Signature header of a message you sent), enter it. Otherwise click Try common selectors to probe about two dozen names used by Google Workspace, Microsoft 365, Mailchimp and other senders.
Click Check domain. The summary at the top gives a grade and lists what to fix first, each with a suggested change.
Open the SPF tree to see every include, the record it pulls in and how many of the 10 allowed DNS lookups each one costs.
Read the DMARC tags and the DKIM key details, then click Copy report to paste the findings into a ticket or email.

Examples

SPF record

v=spf1 include:_spf.google.com ip4:203.0.113.10 ~all

Result (excerpt)

Lookups: 1 of 10
example.com (1 lookup here, 1 including nested)
  include:_spf.google.com (0 lookups here, 0 including nested)
OK  The record ends in ~all (soft fail): mail from unlisted servers is marked suspicious.

DMARC record

v=DMARC1; p=none; rua=mailto:reports@dmarc.example.net

Result (excerpt)

Improve  Policy is p=none: receivers only report, they do not block spoofed mail.
Improve  Reports go to dmarc.example.net, but example.com._report._dmarc.dmarc.example.net has no v=DMARC1 record.

Supported formats

Input: a domain (internationalised names are converted to punycode), an email address such as Name <you@example.com>, or a URL.
SPF (RFC 7208): all mechanisms and modifiers, the 10-lookup and 2-void-lookup limits, include and redirect chains, loops, duplicate includes, ptr, +all, ?all and missing all.
DMARC (RFC 7489 and the DMARCbis np, psd and t tags): policy, subdomain policy, pct, alignment, rua and ruf addresses, with the organisational-domain fallback and external report authorisation (<domain>._report._dmarc.<destination>).
DKIM (RFC 6376, RFC 8463): v, k, p, t and h tags; RSA key size read from the public key (SubjectPublicKeyInfo or PKCS#1), Ed25519 keys and revoked (empty p=) keys; CNAME chains to a provider are followed.
Also shown: MX records (including null MX), BIMI (default._bimi), MTA-STS (_mta-sts) and TLS-RPT (_smtp._tls) records.

Privacy

This tool has to contact a third-party service to answer, so what you enter is sent to that service. See the network notice above and the privacy policy for details. Privacy policy.

Limitations

DKIM has no list of selectors in DNS. If yours is not one of the common names, the tool cannot find it; a missing key there does not mean DKIM is off, so DKIM is left out of the grade unless a key is found.
This checks published records, not real messages. It does not send mail, verify a signature or test alignment between your From address and the servers that actually send for you.
The organisational domain is worked out from a short built-in list of two-part suffixes (such as co.uk), not the full Public Suffix List, so rare suffixes may be handled as ordinary domains.
SPF macros (%{i} and similar) depend on each message, so includes that use them are listed but not expanded or counted.
Answers come from Google Public DNS's cache. A record you just changed may show its old value until its TTL expires.
Does not fetch the BIMI logo or the MTA-STS policy file; it only reports whether the DNS records exist.

FAQ

What does SPF "too many DNS lookups" mean?

Receivers stop evaluating SPF after 10 mechanisms that need a DNS lookup (include, a, mx, ptr, exists and redirect), counted across every nested include. Past that, SPF returns a permanent error and fails. The include tree here shows which entries cost the most so you can remove or flatten them.

Is p=none safe to leave in place?

p=none only asks for reports; spoofed mail is still delivered. It is the right first step while you read the aggregate reports, but the protection comes from p=quarantine or p=reject.

How do I find my DKIM selector?

Open the full headers of an email sent from your domain and find the DKIM-Signature header. The s= tag is the selector and d= is the domain it is published under. Microsoft 365 uses selector1 and selector2, and Google Workspace uses google by default.

Why does it say the rua address is not authorised?

When DMARC reports go to a different domain, that domain must publish a TXT record at <your domain>._report._dmarc.<their domain> to agree to receive them. Without it, receivers drop the reports. DMARC reporting services publish these for their customers.

What is sent to Google?

Only DNS names: your domain, names built from it, and the names its records point to. These are the same queries any mail server makes when it receives your mail. The mailbox part of an email address is removed in your browser before anything is sent.

Is a 1024-bit DKIM key still OK?

It still verifies, but it is considered legacy. 2048-bit RSA is the current recommendation, and keys shorter than 1024 bits are rejected by major mailbox providers.