Free tool
Check SPF, DKIM and DMARC for any domain
Reads the DNS records that decide whether your email reaches an inbox: SPF, DKIM, DMARC and MX. Definitive rather than heuristic — either the record is published or it is not.
Reads public DNS only. Nothing is sent, and nothing is stored.
What these four records do
- SPF
- A TXT record listing which servers may send mail as your domain. A receiver compares the connecting server against it. Without one, your mail is unauthenticated; with a permissive +all it passes while protecting nothing, which is worse.
- DKIM
- A cryptographic signature on each message, so a receiver can verify it was not altered and really came from you. It is the half of authentication that survives forwarding, which SPF does not. Selectors cannot be enumerated from DNS — only guessed — so a miss here is inconclusive rather than a failure.
- DMARC
- Tells receivers what to do when SPF and DKIM fail, and is the only one of the three that reports back who is sending as you. Google and Yahoo have required it for bulk senders since February 2024.
- MX
- Where mail addressed to your domain should be delivered. Without it you cannot receive replies — and receivers are wary of domains that send but cannot receive.
Deliverability is four of 113 checks
The full audit runs these alongside everything else a launch depends on — indexability, AI crawler access, structured data, consent ordering, security headers — against your live URL, and returns the fix for your framework. No account.
Run the full audit