Check a domain's SPF, DKIM, and DMARC records in one go - see which are published, whether DMARC is actually enforcing, and what each result means in plain language. The lookups run against live DNS. No account, no card.
What the three records prove
SPF, DKIM, and DMARC are the DNS records that let a receiving server decide whether a message really came from your domain. The full guide to email authentication walks through how they fit together; here's the short version:
SPF - who may send
A published list of the servers allowed to send mail for your domain. Missing SPF means receivers can't tell your senders from a spoofer's.
DKIM - a tamper-proof signature
A cryptographic signature on each message, verified against a public key at your selector. It proves the mail wasn't altered in transit.
DMARC - the policy and the reports
Tells receivers what to do with mail that fails SPF and DKIM, and sends you reports. See how to set up DMARC to move from monitoring to enforcement safely.
Why it matters for the inbox
Since 2024, Gmail and Yahoo require bulk senders to authenticate with SPF, DKIM, and an aligned DMARC record - mail that doesn't is throttled or rejected outright. The Google and Yahoo sender requirements spell out the full checklist. Authentication is necessary but not sufficient, though: passing records make you eligible for the inbox, while reputation, engagement, and a clean list are what actually get you delivered.
SPF, DKIM & DMARC checker FAQ
They're three DNS records that together prove your mail is genuine. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature receivers can verify against a published public key. DMARC ties the two together - it tells receivers what to do when a message fails both checks (monitor, quarantine, or reject) and where to send reports. You want all three in place.
A DKIM key is published at selector._domainkey.yourdomain, and each sending service picks its own selector name (Google uses "google", others use "selector1", "k1", and so on). DNS gives no way to list which selectors exist, so a checker can't find a key without knowing the selector. If you leave the field blank, this tool probes a short list of common selectors as a best-effort guess - enter your exact selector for a definitive answer.
The p= tag is the DMARC policy. p=none is monitor-only: receivers still report on messages that fail authentication, but they don't act on them, so nothing is actually blocked. It's the right place to start while you confirm your legitimate mail passes, but it offers no spoofing protection on its own. Once your reports look clean, move to p=quarantine and then p=reject to enforce.
No. Passing SPF, DKIM, and DMARC is table stakes: it authenticates that mail is really from you, and Gmail and Yahoo now require it from bulk senders. But it doesn't guarantee placement. Inbox vs. spam still depends on your sender reputation, engagement, content, complaint rate, and list quality. Authentication gets you eligible; a clean list and good sending habits get you delivered.
Authenticated - now send to a clean list
SPF, DKIM, and DMARC prove your mail is genuine; verifying your list keeps bounces and spam traps from undoing that. Start free with 100 credits, no card required.
