mark_email_read Email DNS Checker (SPF, DKIM, DMARC) star

How Email Authentication Works

Three DNS records work together to stop someone from sending forged mail that appears to come from your domain. SPF (Sender Policy Framework) publishes a list of servers explicitly authorized to send mail for the domain — a receiving server checks the connecting IP against that list. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing message; the receiving server fetches your public key from DNS and verifies the signature was not altered in transit, something SPF alone cannot detect. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together: it tells receiving servers what to do when SPF or DKIM fails — do nothing, send to spam, or reject outright — and it asks for aggregate reports so you can see who is actually sending mail as your domain, impersonators included.

Concrete example: without any of these three records, an attacker can send an email that appears to come from [email protected], and most mail servers will deliver it straight to the recipient's inbox with no warning shown to them. Enter your domain into the checker above and it queries MX, SPF, DKIM (trying common selectors automatically) and DMARC over DNS-over-HTTPS, then flags exactly what is missing: no SPF record at all, a DMARC policy stuck at p=none (monitoring only, offering zero real protection), two competing SPF records (a standards violation that breaks validation entirely), or a missing all mechanism at the end of the SPF string.

What You Should Know

Getting all three records right is not optional for anyone who cares about brand reputation or inbox deliverability — a domain with SPF, DKIM or DMARC gaps is both easier to spoof and more likely to have its own legitimate mail routed to spam, because major providers such as Gmail, Yahoo and Outlook increasingly require full authentication before trusting a sender. The rollout is safe if done in order: publish SPF first, add DKIM signing through your mail provider, then add DMARC starting at p=none so you can watch the aggregate reports without risking real mail — only move to quarantine or reject once every legitimate sending source, such as marketing tools, a CRM or a ticketing system, is confirmed and aligned.

• A single domain can have only one SPF TXT record — if you use multiple services (Google Workspace, a marketing platform, a CRM), merge all of their include mechanisms into one string rather than publishing separate records.
• DKIM selectors are provider-specific: Google Workspace often publishes under "google", Microsoft 365 under "selector1" or "selector2" — if the automatic check finds nothing, look up your provider's exact selector name and enter it manually.
• This tool audits DNS configuration only; it does not check blacklist status or scan message content — those are separate layers of email deliverability that sit on top of a correctly configured DNS foundation.