Check SPF, DKIM and DMARC for any domain

What each record does

Eight checks. Five of them decide whether your mail lands or gets spoofed.

MX

Mail exchangers: the servers that receive mail for the domain. No MX means no inbound mail. A “null MX” (priority 0, host “.”) says so explicitly, which is right for domains that never handle mail.

SPF

One TXT record that lists who may send as the domain. Two rules break it silently: there must be exactly one record, and evaluating it may take at most 10 DNS lookups (every include, a, mx, ptr, exists and redirect counts, nested ones too). Over 10 and receivers stop evaluating it, so SPF fails for all your mail. The checker counts them.

DMARC

Ties SPF and DKIM to the visible From address and tells receivers what to do when both fail: nothing (p=none), spam folder (quarantine) or refuse (reject). The rua address collects daily reports, which is how you find services you forgot about. Gmail and Yahoo require DMARC from bulk senders since 2024.

DKIM

A public key in DNS; your sending service signs each message with the private key. DKIM survives forwarding where SPF does not. Keys live under a selector name, which only your sender knows, so enter it if the common ones are not found. 2048-bit RSA is the norm.

MTA-STS

A TXT record plus a policy file at mta-sts.yourdomain that tells senders to deliver to you only over verified TLS. Without it, anyone on the path can strip encryption.

TLS-RPT

Where senders report failed encrypted deliveries to you. Pairs with MTA-STS: run the policy in testing mode, read the reports, then enforce.

BIMI

Your logo next to your messages in Gmail, Apple Mail, Yahoo and others. Requires DMARC at quarantine or reject, an SVG logo and, for Gmail and Apple, a mark certificate (VMC or CMC).

DNSSEC

Signs DNS answers so they cannot be forged in transit. Switched on at your DNS host and registrar. Required for DANE.

How the grade works

Each check has a weight: DMARC 3, SPF 2, DKIM 2, MTA-STS, TLS-RPT, BIMI and DNSSEC 1 each. Passing gives full weight, a warning half, a failure zero. A is 90% and up, B 75%, C 60%, D 40%. Domains that do not receive mail are graded only on SPF, DMARC and DNSSEC, because that is all they need.

Questions

Is it free? Do you store the domains?

Free, no account. The worker asks public DNS (Cloudflare 1.1.1.1) and returns the result. Domains are not saved. Analytics count checks and grades, not domain names.

Why does it say DKIM was not found when my mail is signed?

DKIM keys sit under a selector name chosen by your sending service, and DNS cannot list them. The checker tries 28 common selectors. Enter yours in the optional field; you find it in the service’s DNS setup page or in the “s=” tag of a received message’s DKIM-Signature header.

Should SPF end with ~all or -all?

With DMARC at quarantine or reject, ~all is fine and some providers recommend it, because DMARC makes the decision. Without enforcing DMARC, ~all lets spoofed mail through, so fix DMARC first. Domains that never send should use -all.

How do I move DMARC from none to reject safely?

Start with p=none and a rua address. Read the reports for two to four weeks and add every legitimate sender to SPF and DKIM. Then quarantine, then reject. Skipping the reading step is how invoices and password resets stop arriving.

Does a good grade mean my mail reaches the inbox?

No. Authentication is the entry ticket. Content, sending reputation, complaint rates and list hygiene decide the rest. A bad grade does mean mailbox providers have reasons to distrust you.

Can I check a domain I do not own?

Yes. These are public DNS records, the same ones every mail server reads.