SPF, DKIM & DMARC Checker
Enter a domain to check if it can be spoofed. This free email authentication checker looks up the live SPF, DKIM and DMARC records, grades them A–F and gives you the exact TXT record to fix anything missing.
Results reflect current public DNS records at time of scan. For live SMTP delivery testing, consult your email provider.
Embed this checker on your site
What SPF, DKIM and DMARC each do
SPF — who may send
v=spf1 include:_spf.google.com ~allA TXT record listing the servers allowed to send mail for your domain. Mail from anywhere else is marked suspicious.
DKIM — proof it wasn't altered
selector._domainkeyYour mail server signs every message with a private key; receivers check it against the public key in DNS.
DMARC — the policy
v=DMARC1; p=rejectTells receivers to deliver, quarantine or reject mail that fails SPF and DKIM, and where to send reports.
Why email authentication matters
Stops phishing in your name
Without DMARC enforcement, anyone can send a fake invoice or password reset that looks like it came from you.
Protects your customers
Spoofed mail targets the people who trust your brand. Authentication lets Gmail and Outlook block it before it lands.
Improves deliverability
Google and Yahoo now require SPF, DKIM and DMARC for bulk senders. Missing records push real mail to spam.
How to read your results
Pass
The record exists and is configured to protect you. Keep it updated when you add new sending services.
Warning
The record exists but is weak — for example DMARC p=none, SPF without ~all, or DKIM not found at common selectors.
Fail
The record is missing or broken. Copy the suggested TXT record, adjust it for your provider and add it to your DNS.
New to this? Read SPF vs DKIM vs DMARC explained, what phishing is and how to avoid it, or how DNS works.
Frequently Asked Questions
What is SPF, DKIM, and DMARC?+
SPF, DKIM and DMARC are three DNS records that prove an email really came from your domain. SPF lists the servers allowed to send your mail, DKIM adds a cryptographic signature that shows the message wasn't altered, and DMARC tells receiving servers what to do when a message fails those checks and sends you reports about it.
How do I fix a missing SPF record?+
Add a single TXT record at the root of your domain that starts with v=spf1, lists your mail providers with include: entries, and ends with ~all or -all. For Google Workspace that is v=spf1 include:_spf.google.com ~all. Publish it in your DNS host, wait for it to propagate, then scan again to confirm it passes.
What does a DMARC policy of p=none mean?+
p=none is monitor-only mode. Receiving servers send you reports about mail that fails SPF or DKIM, but they still deliver it normally, so spoofed messages get through. It's a safe first step; once reports show your real senders pass, move to p=quarantine and then p=reject to actually block spoofing.
Will this tool send a test email?+
No. This checker only reads your domain's public DNS records for SPF, DKIM and DMARC. It never connects to your mail server or sends any message. To test real delivery, send a message to a mail-tester service or check the authentication results in your email provider's message headers.
How often should I check my domain's email security?+
Check after any change to your email setup, such as adding a newsletter platform, CRM or new mail provider, since each needs to be in SPF and signed with DKIM. Otherwise a monthly check is enough to catch expired DKIM keys, duplicated SPF records or a DMARC policy left at p=none.