Free — no signup

SPF / DMARC / DKIM Checker

Enter a domain to check whether its mail authentication records — SPF, DMARC, DKIM — and inbound MX are set up correctly. Beyond presence, it validates syntax against RFC 7208 / 7489 / 6376, including the SPF ten-lookup limit.

You can paste a URL or an email address — the domain is extracted for you.
DKIM cannot be discovered from DNS. Enter the selector your provider issued (for example "google" for Google Workspace). Left blank, DKIM is skipped.

What each record protects

MX — whether mail arrives at all

MX records tell the world which server accepts mail for the domain. If MX vanishes or is rewritten, inbound mail stops while the website keeps looking perfectly healthy — which is why these incidents surface late. Check right after any DNS or hosting migration.

SPF — who may send as you

SPF lists the servers allowed to send as your domain. When it breaks, mail is not bounced — it is quietly filtered to spam, which looks like success from the sending side. Note the ten-DNS-lookup cap: adding sending services one by one is how domains cross it without noticing.

DMARC — what to do with spoofed mail

DMARC tells receivers how to treat mail that fails SPF or DKIM. p=none only collects reports — it stops nothing. The usual path is to start at p=none, read the reports until you know who sends as you, then move to quarantine and reject.

DKIM — proof the message is untouched

DKIM signs each message so receivers can verify it with your public key. That key lives in DNS under a selector, which is why you must know the selector to check it. The classic failures are deleting the old selector too early during a rotation, or never publishing the new key at all.

FAQ

Q. Are results stored?

No. The page queries DNS for the domain you enter and renders the result — nothing is persisted.

Q. Does the paid monitor judge differently?

It does not. This checker runs the same parsers as Miterl’s MX / SPF / DMARC / DKIM monitors. The difference is that the monitors run every day and alert you when something breaks.

Q. I do not know my DKIM selector

Your sending provider issues it: Google Workspace uses “google”, SendGrid defaults to s1 and s2, Amazon SES uses a generated string. You can also read it from the s= tag of the DKIM-Signature header on any message you have already sent.

Related reading