SPF, DKIM & DMARC Checker
Check and generate the email authentication records of a domain.
What this checker tests
| Check | What we look for |
|---|---|
| SPF | Exactly one record, valid syntax, a safe all policy and no more than 10 DNS lookups, counted through every include |
| DMARC | A record at _dmarc, the policy (none, quarantine, reject), the reporting address and coverage |
| DKIM | Keys under the selector you enter, or under the most common selectors, and their key size |
| MX | Which servers receive mail for the domain |
| MTA-STS and TLS-RPT | Optional records that protect incoming mail and report TLS problems |
Each finding is marked OK, Warning or Problem, and the score at the top summarizes them.
Finding your DKIM selector
DKIM keys are published under a name you cannot guess reliably: selector._domainkey.example.com. We try common selectors automatically. To be sure, open the headers of an email you sent (see how to read email headers), find the DKIM-Signature line and copy the value after s=. Common ones are google for Google Workspace and selector1 / selector2 for Microsoft 365.
Using the generator
Tick every service that sends email for your domain, add any other servers, choose a policy, and copy the two records into your DNS settings. The generator:
- puts each service's official include in one SPF record,
- warns how many of the 10 DNS lookups the record uses,
- builds a DMARC record that starts safely with
p=noneand a reporting address.
After a few weeks of clean reports, change DMARC to p=quarantine and then p=reject. Learn why in SPF, DKIM and DMARC explained.
Common problems and fixes
| Problem | Fix |
|---|---|
| Two SPF records | Merge them into one v=spf1 record |
| More than 10 DNS lookups | Remove services you no longer use, or replace includes with ip4: / ip6: ranges |
+all or ?all |
Use ~all or -all |
| No DMARC record | Publish v=DMARC1; p=none; rua=mailto:you@yourdomain at _dmarc |
| 1024-bit DKIM key | Generate a new 2048-bit key in your email provider's settings |
Frequently asked questions
Why does Gmail say my emails fail authentication?
Usually SPF or DKIM is missing for one of your sending services, or DMARC alignment fails because the service sends with its own domain. Add the service's include to SPF and turn on DKIM signing in the service.
Do I need DMARC if I only send a few emails?
Yes. DMARC also protects your domain from being used by others to send phishing.
Is it safe to publish these records?
Yes. SPF, DKIM public keys and DMARC are meant to be public.
Learn more
What is email spoofing and how do you spot it?
Email spoofing fakes the sender address to make phishing look real. Learn how it works, how to check if an email is spoofed and how to protect your own domain.
Email · 2 min readIs my IP blacklisted? How to check and get delisted
Find out if your IP is on a spam blacklist (DNSBL), why it was listed and how to get it removed, step by step, plus how to stay off blacklists.
Email · 2 min readSPF, DKIM and DMARC explained
SPF, DKIM and DMARC prove an email really comes from the domain it claims. Learn how each works, how to set them up and what pass, fail and softfail mean.
Other free IP and network tools
IP Lookup
Location, network owner and ASN of any IP address or domain.
ISP Lookup
See which internet provider your connection, or any IP address, belongs to.
VPN Leak Test
One-click check of your VPN: IP, IPv6, WebRTC, timezone and language leaks.
VPN & Proxy Check
Find out if an IP belongs to a VPN, proxy or Tor exit node.
Open Port Checker
Test whether a port on your connection is open to the internet.
Online TCP Ping
Measure how fast a server answers on a port, from our worldwide network.
Blacklist Check
Test an IPv4 address against 20+ spam blacklists.
DNS Lookup
A, AAAA, MX, NS, TXT, CNAME, SOA and CAA records of a domain.
DNS Propagation Checker
Compare a DNS record across 13 public resolvers at once.
Website IP Lookup
Find the IP addresses, hosting company and CDN of any website.
Reverse DNS
Find the hostname behind an IP address.
WHOIS Lookup
Owner and registration data for a domain or IP address.
Domain Age Checker
How old a domain is, when it was registered and when it expires.
Email Header Analyzer
Trace where an email came from and check SPF, DKIM and DMARC.
SSL Certificate Checker
Expiry date, issuer and covered names of a website certificate, plus HTTPS checks.
HTTP Headers Checker
See redirects, response headers and a security grade for any URL.
Is It Down?
Check if a website is down for everyone or just for you.
Subnet Calculator
Network, broadcast, host range and subnets for IPv4 and IPv6.
IP Converter
Convert IPs to decimal, hex and IPv6, and CIDR blocks to address lists.
Bulk IP Lookup
Look up to 25 IP addresses at once and export the results as CSV.
Browser Fingerprint
See what your browser shares with every site you visit.
WebRTC Leak Test
Check if your real IP leaks past your VPN through WebRTC.
IP Widget for Your Site
Free "What is my IP" box for your website or blog, with one line of code.