Email Authentication Check — SPF, DKIM & DMARC
Check whether your domain has a valid SPF, DKIM and DMARC setup. With an overall grade, concrete recommendations and copy-paste-ready DNS records — free, no signup.
Articles related to this tool
How the SPF, DKIM & DMARC check works
Our tool queries your domain's public DNS records live: the SPF record on the apex domain, the DMARC record on _dmarc.your-domain and the DKIM key on selector._domainkey.your-domain. From the results we compute an overall grade from A to F and give a concrete recommendation per protocol with a ready-made DNS record to copy. No test email is sent.
Why SPF, DKIM and DMARC belong together
Together these three DNS-based methods prove that an email really comes from your domain. SPF defines which servers may send for your domain. DKIM signs each message cryptographically so the recipient can verify authenticity and integrity. DMARC ties the two together, tells the recipient what to do with unauthenticated mail and delivers reports. Only all three together protect effectively against spoofing and improve deliverability.
Why this became mandatory in 2024/2025
Since February 2024 Google and Yahoo require bulk senders (from roughly 5,000 messages/day) to have SPF, DKIM and at least DMARC p=none. Microsoft follows in 2025. Without these records, mail is increasingly rejected or filed as spam — regardless of content. Smaller senders benefit too: correct authentication is one of the strongest levers for inbox placement today.
How to read the result
The overall grade summarises all three checks. Per protocol you see a status — Pass, Notice, Warning or Critical — with a concrete recommendation and, where needed, a ready-made DNS TXT record to copy. Important for DKIM: selectors cannot be enumerated via DNS. If the automatic probe finds nothing, that does not mean "no DKIM" — enter your selector (from the mail header after s=) and check again. If your sending IP is also on a blacklist, the Blacklist Check helps; all DNS records are shown in the DNS Lookup.
Frequently asked questions about SPF, DKIM & DMARC
Why do my emails land in the spam folder?
The most common cause is missing or broken email authentication. If SPF, DKIM or DMARC are missing, Gmail, Outlook & co. cannot verify that the mail really comes from your domain — and filter it out as a precaution. Check your domain above and follow the concrete recommendations. Other causes: a listed sending IP (see the Blacklist Check) or a missing PTR record.
SPF, DKIM and DMARC — what is the difference?
SPF defines which servers may send for your domain. DKIM signs each message cryptographically so the recipient can verify authenticity and integrity. DMARC ties the two together and tells the recipient what to do with unauthenticated mail (nothing / spam / reject) — and delivers reports. Only all three together protect effectively against spoofing.
Where do I find my DKIM selector?
The selector is in the header of a real message you sent: look for DKIM-Signature: and the s= tag — the value after it is your selector. Alternatively your provider names it (e.g. Google Workspace: google, Microsoft 365: selector1/selector2). Our tool probes the most common selectors automatically, but entering it manually is more reliable.
What do DMARC p=none, p=quarantine and p=reject mean?
p=none is pure monitoring — nothing happens, you only receive reports. p=quarantine moves unauthenticated mail to the spam folder. p=reject refuses it entirely and offers the strongest protection. Recommendation: start with p=none, review the reports, then raise the policy to quarantine and reject step by step.
Do I meet the Gmail and Yahoo requirements?
Bulk senders (from roughly 5,000 messages/day) have needed SPF, DKIM and at least DMARC p=none since 2024; Microsoft follows in 2025. If our check reports "Pass" for all three and a DMARC record exists, you meet the baseline requirement. Without these records your mail is increasingly rejected.
Can I have multiple SPF records?
No. Exactly one SPF TXT record is allowed per domain (RFC 7208). Multiple SPF records cause a PermError and therefore a failed check. Combine all senders into one single record — and watch the limit of 10 DNS lookups.