SPF, DMARC & DKIM checker
Find out whether anyone can send email pretending to be your domain - and whether your real mail lands in spam. We read your SPF, DMARC, DKIM, MTA-STS and TLS-RPT records and explain every problem.
Reads only public data. Results are not stored.
What this tool checks
SPF tells receivers which servers may send your mail, DKIM signs it, and DMARC tells them what to do with mail that fails both. Missing or lax records are the reason invoice fraud and phishing in a company's name work. Since 2024 Google and Yahoo also require DMARC from anyone sending in bulk.
- SPF record published
- SPF rejects unlisted senders
- SPF within the 10-lookup limit
- SPF avoids the deprecated ptr mechanism
- DMARC record published
- DMARC enforces quarantine or reject
- DMARC protects subdomains
- DMARC reports collected
- DKIM signing key published
- DKIM key at least 2048-bit
- MTA-STS enforces encrypted delivery
- SMTP TLS reporting enabled
Questions
What is a good DMARC policy?
p=reject with an rua address for reports. Start with p=none to collect reports, fix the legitimate senders that fail, then move to p=quarantine and p=reject.
Should SPF end in -all or ~all?
-all once every legitimate sender is listed. ~all is acceptable while DMARC enforces quarantine or reject; on its own it lets spoofed mail through.
Why does the checker not find my DKIM key?
DKIM keys live under a selector name that cannot be listed through DNS. We try the selectors used by common providers; a custom selector may still exist.