Some providers use custom selectors. This checker tests common selectors and reports if none are detected — your provider's documentation will list the exact selector name in use.
Free Email Security Tool
SPF, DKIM & DMARC Checker + Generator
Check your domain's email authentication in seconds, and build correct SPF, DKIM, and DMARC DNS records with our free generators. Reduce spoofing risk and improve inbox placement.
- ✔ SPF, DKIM & DMARC lookup
- ✔ Record generators included
- ✔ Keys generated in your browser
- ✔ Free Forever
Diagnose Email Authentication Gaps in Seconds
SPF, DKIM, and DMARC are the three DNS-based standards that tell receiving mail servers whether an email claiming to be from your domain is legitimate. Missing or misconfigured records are one of the most common causes of email landing in spam — or worse, of attackers being able to spoof your domain convincingly.
This free tool checks your domain's SPF and DMARC records directly over DNS, probes common DKIM selectors, and includes generators to help you build correct records from scratch — including a DKIM keypair generator that runs entirely in your browser.
How It Works
1. Enter Your Domain
Type your domain and click Run Check — no login required.
2. We Query DNS Directly
Your browser looks up SPF and DMARC TXT records and probes common DKIM selectors, using a public DNS-over-HTTPS resolver.
3. Review & Fix
See a clear pass/fail summary, then use the generators below to build corrected records.
Enter a domain and run a check to see SPF, DKIM, and DMARC status.
Checks run using the DNS-over-HTTPS resolver selected above, queried directly from
your browser. Your domain name is sent to that resolver to look up its records — the
same as any DNS lookup — but nothing is stored on our servers. Some networks or
browser extensions block specific resolvers; if a check fails, try switching to a
different resolver from the dropdown.
Domains your mail is sent through, e.g. _spf.google.com, mailgun.org, sendgrid.net
Keys are generated locally in your browser using the Web Crypto API and are never
transmitted anywhere. Save the private key immediately — closing or refreshing this
page will permanently lose it, since nothing is stored.
Email Authentication
What Each Record Does
SPF
Lists which mail servers are allowed to send email for your domain. Receiving servers check the sending IP against this list.
DKIM
Cryptographically signs outgoing mail so receivers can verify it wasn't altered in transit and genuinely came from your domain.
DMARC
Tells receiving servers what to do when SPF or DKIM checks fail, and where to send reports about authentication activity.
FAQsSPF, DKIM & DMARC
Why might DKIM show missing even when it is configured?
What DMARC policy is best?
Most organizations progress from p=none to p=quarantine and then p=reject after a monitoring period confirms legitimate mail is passing authentication.
Is my domain data uploaded to your servers?
The checker looks up DNS records using a public DNS-over-HTTPS resolver of your choice (Cloudflare, Google, Quad9, OpenDNS, or AdGuard) directly from your browser. Your domain name is sent to that resolver to perform the lookup, but nothing is stored on our servers.
Why does the checker let me pick a DNS resolver?
Different resolvers occasionally cache records for different lengths of time, and some networks block specific resolvers. Offering a choice lets you cross-check a result or work around a blocked resolver without leaving the page.
Is the DKIM private key stored anywhere?
No. The DKIM keypair is generated locally in your browser using the Web Crypto API and is never transmitted or stored. Save it immediately, since refreshing the page will lose it permanently.