SPF / DMARC / DKIM Checker
Enter a domain to check whether its mail authentication records — SPF, DMARC, DKIM — and inbound MX are set up correctly. Beyond presence, it validates syntax against RFC 7208 / 7489 / 6376, including the SPF ten-lookup limit.
What each record protects
MX — whether mail arrives at all
MX records tell the world which server accepts mail for the domain. If MX vanishes or is rewritten, inbound mail stops while the website keeps looking perfectly healthy — which is why these incidents surface late. Check right after any DNS or hosting migration.
SPF — who may send as you
SPF lists the servers allowed to send as your domain. When it breaks, mail is not bounced — it is quietly filtered to spam, which looks like success from the sending side. Note the ten-DNS-lookup cap: adding sending services one by one is how domains cross it without noticing.
DMARC — what to do with spoofed mail
DMARC tells receivers how to treat mail that fails SPF or DKIM. p=none only collects reports — it stops nothing. The usual path is to start at p=none, read the reports until you know who sends as you, then move to quarantine and reject.
DKIM — proof the message is untouched
DKIM signs each message so receivers can verify it with your public key. That key lives in DNS under a selector, which is why you must know the selector to check it. The classic failures are deleting the old selector too early during a rotation, or never publishing the new key at all.
FAQ
Q. Are results stored?
No. The page queries DNS for the domain you enter and renders the result — nothing is persisted.
Q. Does the paid monitor judge differently?
It does not. This checker runs the same parsers as Miterl’s MX / SPF / DMARC / DKIM monitors. The difference is that the monitors run every day and alert you when something breaks.
Q. I do not know my DKIM selector
Your sending provider issues it: Google Workspace uses “google”, SendGrid defaults to s1 and s2, Amazon SES uses a generated string. You can also read it from the s= tag of the DKIM-Signature header on any message you have already sent.