SPF, DKIM and DMARC checker

What this actually checks

Four things decide whether a receiving server trusts mail claiming to come from your domain. This reads all four from live DNS and grades them, so it does the job of a separate DMARC checker, DKIM checker, SPF checker and MX lookup in one pass, and then tells you what the answers mean together rather than four results you have to reconcile yourself.

MX says who receives mail for the domain. No MX means every message sent to any address there bounces.

SPF is the list of servers allowed to send as you. The trap is not the syntax, it is the limit: RFC 7208 caps evaluation at ten DNS-querying mechanisms, counted recursively through every include. Cross it and SPF returns permerror, which means it stops authenticating you entirely. Most people who hit this never find out, because nothing visibly breaks until delivery quietly degrades. This checker resolves your includes and counts the real number.

DKIM is a signature that survives forwarding, which is the reason it matters more than SPF. It has no discovery mechanism, so no tool can list your selectors. This one tries a set of well-known selector names used by the major providers. Not finding a key is a hint, not a verdict.

DMARC ties the other two to the address a human actually sees, and tells receivers what to do when they do not match. A record with p=none monitors and enforces nothing, which is where most domains stop and stay.

What to do with a bad result

Fix in this order, because each step depends on the one before it.

1. Publish SPF if it is missing, and get the lookup count under ten if it is over. Removing one unused include is usually enough.
2. Turn on DKIM with your sending provider. Every serious provider offers it; it is normally two CNAME records.
3. Publish DMARC at p=none with a rua= address. Read the reports for two weeks. They will show you which of your senders are failing alignment, which is almost always something you forgot you were using.
4. Move to p=quarantine, then p=reject. Only after the reports are clean. Our own domain sat at quarantine for weeks before we moved it, and we only moved it after checking every aggregate report showed full alignment.

The deliverability field guide covers the reasoning in full, and setting up business email has the literal records to paste.

Why we built this

Because we have to run these checks constantly on our own domains, and because getting them wrong is expensive in a way that is invisible until it is not. Gmail and Microsoft both require authentication from bulk senders now, and unauthenticated mail is refused rather than filtered.

Nothing here is stored. The lookups run server-side over DNS-over-HTTPS so your browser is not making the queries, and the result is not written anywhere. If you want to check a single message rather than a domain, the email header analyzer reads the authentication results from raw headers, and the DMARC record generator writes a policy record for you.