SPF, DKIM and DMARC checker: free, runs in your browser
Type a domain to check its email-authentication records. The lookups go from your browser straight to a public DNS-over-HTTPS resolver (Cloudflare). We run no server for this page, and the domain you type is not sent to us or stored.
What each check looks at
- SPF: a TXT record on the domain starting
v=spf1that lists the servers allowed to send for it. We flag a missing record, more than one record, more than 10 DNS-lookup terms and a permissive ending. - DMARC: a TXT record at
_dmarc.yourdomain.comthat tells receivers what to do with mail that fails authentication.p=noneonly monitors;quarantineandrejectenforce. - DKIM: a public key at
selector._domainkey.yourdomain.com. We try five common selectors (google, selector1, selector2, k1, default). A provider can use any selector name, so "not found" is a warning, not a verdict.
Why these records matter
Google and Yahoo publish requirements for senders of bulk mail (SPF, DKIM and a DMARC policy, among others), and Microsoft has announced similar rules for its consumer mail services. Having the records in place is one of the conditions mailbox providers look at. No record set can promise that a message will be delivered or avoid spam folders: that depends on your content, sending history and the receiver.
Related: the email header analyzer shows how one real message authenticated, and DMARC monitoring (early-access list, not live yet) is planned to re-check your domains every week.
Want the records drafted for you? Flat $29
We draft your SPF, DKIM and DMARC records: $29 flat per domain. Email datagleaner@gmail.com with your domain, your mail provider and any other services that send mail for it.
What the $29 covers
- We check your current records and draft a tailored set: the SPF record, the DMARC record (starting at monitoring, with a path to enforcement) and the DKIM steps for your provider.
- You receive the exact record names and values to paste, with plain instructions for your DNS host.
- One re-check of the same domain after you publish, using this page's checks, with a short note on anything still failing.
What it does not cover
- You publish the records in DNS yourself. We never ask for, and do not want, your DNS or mail logins.
- We do not run your mail system, read your mail or monitor reports. DMARC report analysis is not included.
- No guarantee of inbox placement or delivery, and no legal or compliance advice. The records are drafted from what you tell us and what the public DNS shows; list every sender or a legitimate service may fail authentication.
How payment works
There is no checkout page yet. We reply with a scope confirmation and an invoice for $29 (USD); work starts when it is paid, and records go back by email, usually within one business day. If we cannot draft the set from the information supplied, we ask for what is missing or refund in full.
Limits of this checker
It reads public DNS only and checks one domain at a time. It does not test subdomains, BIMI, MTA-STS or whether your provider is actually signing mail. DKIM covers five common selectors only.
Related guides
- Email header analyzer: free, runs in your browser
- DMARC monitoring: weekly SPF, DKIM and DMARC re-checks (early access)
- Done-for-you company contact lists from your list of websites
- We fill your GPSR product fields for you (WooCommerce, Tidyleaf import CSV)
- Free GPSR product information sheet generator (print sheet and Tidyleaf import row)