DMARC, SPF and DKIM checker
Check your DMARC, SPF and DKIM records the way a mail server reads them.
One lookup reads every record together, follows each SPF include, and names the services authorised to send as you. Free and no account. The result describes public records and can be shown at a public report link; who asked is not stored.
Read in this scan
- Identity
- SPF · DKIM · DMARC · BIMI
- Delivery
- MX · A/AAAA · PTR
- Transport
- MTA-STS · TLS-RPT · STARTTLS
- Foundation
- DNSSEC · CAA · NS/SOA
A scan cannot tell you who has been sending
This is a photograph of your DNS this second. Who actually sent as you, from where, and whether it passed only arrives in aggregate reports, over days, from the mailbox providers themselves.
Start monitoring, free for two domains →Questions about this check
What does this scan check?
It reads your domain's SPF, DKIM, DMARC and BIMI records; your MX hosts, their addresses and reverse DNS; MTA-STS, TLS-RPT and DANE; and DNSSEC and CAA. It follows every SPF include and names the services authorised to send as you. It reads DNS, so it cannot see your mail.
What is the SPF 10-lookup limit?
RFC 7208, section 4.6.4, caps an SPF check at 10 terms that need a DNS lookup: the include, a, mx, ptr and exists mechanisms and the redirect modifier. A record needing more returns a permanent error, so SPF cannot pass for any message. The scan follows every include and counts them. The fix is dropping an include, not flattening.
What do DMARC p=none, quarantine and reject do?
They tell receivers what to do with mail that fails DMARC for your domain. p=none: deliver it as normal and send you reports, which shows who sends as you but blocks nothing. p=quarantine: treat it as suspicious, usually the spam folder. p=reject: refuse it. DMARC is defined in RFC 9989, published in May 2026.
Why might DKIM show no keys?
A DKIM key is published at a selector, such as selector1._domainkey.example.com, and selectors cannot be listed from DNS. So the scan checks the documented default selectors of each service your SPF record and MX hosts name. No key there is a question, not a verdict: add your custom selectors above and they are checked too.
Is p=none enough for Gmail, Yahoo and Outlook.com?
For their bulk-sender rules, yes. Google, Yahoo and Microsoft require bulk senders to publish a DMARC record, and p=none meets that minimum, alongside SPF and DKIM. It does not meet any requirement to stop impersonation of your domain: at p=none, receivers deliver mail that fails DMARC as they would without a policy.
What if the domain does not exist?
Then there is nothing to grade, and the scan says so instead of giving a grade. A domain is reported as not existing only when its nameservers answer NXDOMAIN, no such domain, for its SOA, NS, MX and TXT records. A lookup that times out proves nothing either way, so it is reported as an incomplete scan.