SPF, DKIM & DMARC Checker

About this tool

Enter a domain and the tool looks up its public DNS records over DNS-over-HTTPS. For SPF it reads the v=spf1 record, follows include and redirect terms to count the DNS lookups (the limit is 10) and flags problems such as +all, a missing all term or duplicate records. For DMARC it reads the record at _dmarc.<domain> and explains the policy, percentage and reporting address. For DKIM it checks the selector you give, or tries a short list of common ones such as google, selector1 and s1. DKIM selectors are chosen by your mail provider and cannot be listed from DNS, so finding none is not proof that DKIM is missing. It also reads three newer records. MTA-STS (RFC 8461) tells sending servers to use TLS and which mail servers are valid; the tool fetches the policy file from mta-sts.<domain> over HTTPS without following redirects, as senders do, and checks that every MX host is covered. TLS-RPT shows where delivery-failure reports go. BIMI shows whether a brand logo record is published and whether DMARC enforcement, which BIMI needs, is in place. The checks use public DNS and that one policy file, and never send mail.

How to use it

1. Enter the domain you send mail from, for example example.com.
2. Optionally enter your DKIM selector. Your email provider lists it in its setup instructions.
3. Press Check email authentication.
4. Work through any red or amber findings, then check again after DNS has had time to update.

Common problems

No DKIM key is found but mail is signed

Your provider uses a selector that is not on our short list. Enter it in the selector field, found in the DKIM header of a sent message as s=.

SPF shows more than 10 lookups

Remove includes for services you no longer use, or replace some with direct ip4 and ip6 ranges. Over 10 can make SPF fail permanently.

DMARC is not found on a subdomain

Receivers fall back to the parent domain's DMARC record. This tool checks only the exact domain you enter.

MTA-STS says my MX host is not covered

Add the host or a wildcard like *.example.com to the mx lines of your policy file. A wildcard matches exactly one label, so it does not cover the bare domain or deeper names.

BIMI is published but no logo appears

Mailbox providers need DMARC at quarantine or reject for all mail, an SVG Tiny PS logo, and usually a Verified Mark Certificate. The tool checks the first two and shows whether a certificate is listed.