SPF/DKIM/DMARC Checker
Enter a domain to check its SPF, DKIM and DMARC email authentication records - the DNS records mailbox providers use to decide whether email claiming to be from your domain is legitimate.
DKIM records are selector-specific, so a lookup needs the exact selector your email provider uses. Not sure? Leave it blank to try "default", or check common provider values like "google" (Google Workspace) or "selector1" (Microsoft 365) in your provider's setup documentation.
Häufig gestellte Fragen
What are SPF, DKIM and DMARC?
SPF (Sender Policy Framework) lists which mail servers are allowed to send email as your domain. DKIM (DomainKeys Identified Mail) lets receiving servers verify a message wasn't altered in transit, using a cryptographic signature tied to a selector. DMARC (Domain-based Message Authentication) tells receiving servers what to do when a message fails those checks, and where to send reports.
What's a DKIM selector, and why do I need one?
DKIM public keys are published at "<selector>._domainkey.<yourdomain>", so the selector is part of the lookup address, not something fixed - different providers (and even different campaigns from the same provider) can use different selectors. If you're not sure yours, check your email provider's DKIM setup page, or try a common default they document.
Why does DMARC policy matter?
A DMARC policy of "none" only monitors; "quarantine" sends failing mail to spam; "reject" blocks it outright. Domains with no DMARC record at all give receiving mail servers no guidance, which can make it easier for someone to spoof your domain in phishing emails.
Does this tool send any email or make any changes?
No, this only reads existing public DNS TXT records for the domain you enter - the same records any mail server checks. Nothing is sent, and nothing on your domain is changed.