SPF, DKIM, and DMARC Checker

This tool inspects email DNS records for a domain.

It parses SPF permissions, traces each include and redirect, checks DKIM selector records, reads the DMARC policy, and sorts MX hosts by priority. It also reads the MTA-STS, SMTP TLS Reporting, and BIMI records.

Each finding shows the observed DNS string, the effect on delivery, and one step that corrects it.

The SPF trace stops at the RFC 7208 limit of 10 DNS lookups. It counts void lookups against the RFC limit of 2, and it flattens the authorized IPv4 and IPv6 ranges.

The grade adds points for each check and shows the points of each one. It rates the DNS records only. It does not measure inbox placement, and it gives no delivery guarantee. The tool reads DNS only. It does not fetch the MTA-STS policy file over HTTPS, and it does not send test messages.

A DKIM selector is a free label, so DNS gives no way to list every selector of a domain. The tool checks the selectors that you give, plus a short default list. It does not try hundreds of names. Read the s= tag in the DKIM-Signature header of a sent message to find your selector.

A failed DNS query and an absent record are not the same. The tool marks a failed query as a warning, because the record status is then unknown.

DMARC is the record that mailbox providers use. It tells them what to do when SPF and DKIM fail. A domain with p=none gets no protection.

Enter a domain. Optionally set DKIM selectors. Then select Inspect.

This tool does not store your input.