Free tool
SPF, DKIM & DMARC Checker
Enter a domain to check its email authentication setup — see what's passing, what's missing, and how to fix it.
Free, no sign-up. Lookups run via public DNS-over-HTTPS — your domain isn't stored anywhere.
What each record does
| Record | Purpose | Lives at |
|---|---|---|
| SPF | Authorizes which servers can send for your domain | TXT on the domain itself |
| DKIM | Signs each message to prove it wasn't altered | TXT at <selector>._domainkey.domain |
| DMARC | Policy for what to do on SPF/DKIM failure | TXT at _dmarc.domain |
| MX | Where incoming mail for your domain is routed | MX on the domain itself |
Fixing what the checker flags
- SPF missing/fail — add or fix your TXT record; end it with
-allonce confident. - DKIM missing — enable DKIM signing in your email provider's admin panel; try other selector presets.
- DMARC missing/p=none — add a DMARC TXT record starting at
p=none, then tighten toquarantine→reject. - MX missing — you won't receive mail at all; add MX records from your provider.
Passing auth isn't the whole picture
Correct SPF/DKIM/DMARC stops spoofing — but sender reputation still decides inbox vs. spam. MailPilot warms up your mailbox to build that trust automatically.
Start free warmupSPF, DKIM & DMARC checker — FAQ
What do SPF, DKIM, and DMARC do?
SPF lists which mail servers are allowed to send email for your domain. DKIM cryptographically signs each message so receivers can verify it wasn't altered. DMARC tells receiving servers what to do when SPF or DKIM fail, and lets you monitor who's sending as you. Together they prove your mail is legitimate — missing any one makes providers treat your mail as unverified.
Why did my DKIM check come back missing?
DKIM records live at a selector-specific subdomain, like google._domainkey.yourdomain.com — if you pick the wrong selector for your provider, the record won't be found even though it exists. Try your provider's default: Google Workspace usually uses “google”, Microsoft 365 uses “selector1” or “selector2”. Check your provider's admin panel for the exact selector if none of the presets match.
What does p=none mean in my DMARC record?
p=none is monitor-only mode — DMARC reports are generated, but no enforcement happens: mail that fails SPF/DKIM still gets delivered normally. It's the right starting point while you verify your setup, but you should move to p=quarantine and then p=reject once you confirm legitimate mail isn't failing, or you get no real protection against spoofing.
Do I need all three records, or is one enough?
You need all three for full protection. SPF alone can be bypassed by forwarding. DKIM alone doesn't tell receivers what to do on failure. DMARC ties SPF and DKIM together and enforces a policy — but DMARC only works if at least one of SPF or DKIM is set up correctly underneath it.
Is this checker free and does it store my domain?
Yes, completely free with no sign-up. Lookups run through public DNS-over-HTTPS resolvers directly from your browser — we don't store, log, or see the domains you check.