Email authentication checker

Enter your domain above. The checker reads the domain's public DNS — MX, SPF, DKIM and DMARC records — the same way mailbox providers do when they decide where to file a message, and reports what each record says, what is missing, and what to fix first. It is free, needs no account, and performs read-only DNS lookups.

SPF (Sender Policy Framework) is a TXT record that lists which servers may send mail for a domain. Receivers compare the server that delivered a message against that list. A record must resolve in 10 DNS lookups or fewer — a longer chain fails with a permanent error even though the record looks fine, which is why SPF records should be trimmed as include chains accumulate.

A DKIM record is a TXT record at <selector>._domainkey.<your-domain> holding a public key; the matching private key stays on the sending side. Receivers use it to verify that a message was signed by the domain and was not altered in transit. The selector is chosen by the sending service — Google uses "google", Microsoft 365 uses "selector1" and "selector2" — which is why a checker must probe common selectors, and why a "not found" result is not final proof.

DMARC ties SPF and DKIM to the domain in the visible From line, and tells receivers what to do when a message fails both: nothing (p=none), treat it as suspicious (p=quarantine), or reject it (p=reject). It also points at a rua= address that receives aggregate reports — a daily summary of who is sending as your domain and whether their mail authenticated. SPF alone cannot stop spoofing because it never checks the From line; DMARC is the policy that does.

Add what is missing first — SPF, then DMARC — and tighten what already works second. Publishing DMARC with p=none starts the aggregate reports without changing delivery; once the reports show that only legitimate mail fails, move to p=quarantine, then p=reject. Add DKIM for every service that sends for you. The Sendfeather domain guide walks through publishing the exact records in order.