Skip to content
dnsdon

Email Authentication Checker

Check SPF, DKIM and DMARC: the records inboxes use to decide whether your mail is genuine, and whether they are strict enough to stop spoofing.

Enter a domain or hostname. Pasted URLs and internationalized names work too.

Find it as s= in the DKIM-Signature header of a sent message. Up to 5, separated by commas. Leave empty to try common ones.

What this checks

  • MX records, including "null MX" for domains that receive no mail
  • SPF syntax, default policy and the 10-lookup limit, following every include
  • DMARC policy, enforcement level and report authorization
  • DKIM keys at your selector, with key length
  • MTA-STS: the policy file, its certificate and whether it covers every MX
  • TLS-RPT reporting, and the BIMI logo file and its DMARC requirement
  • Reverse DNS (PTR) for each mail server

How to read the results

Pass
The check succeeded based on the observed responses.
Warning
Works now, but is risky, unusual or worth reviewing.
Fail
A problem was observed directly in the responses.
Inconclusive
Not enough evidence — for example a server did not respond.