Email Authentication Checker

Enter a domain name to check its SPF, DKIM and DMARC records — the three things that stop others from sending mail as you.

You can paste a URL or an email address — only the domain part is used.

DKIM selectors
DKIM selectors

What gets checked

SPF
Expands include and redirect recursively, and flags dangerous settings such as exceeding the 10 DNS lookup limit or publishing +all.
DKIM
Selectors cannot be enumerated from DNS, so you can either scan a list of widely used selectors or enter the ones you already know. Key length and revocation are checked as well.
DMARC
Beyond policy strength, it verifies the authorisation record (_report._dmarc) required when reports are sent to an external domain.

Queries go through DNS over HTTPS (the public Cloudflare and Google resolvers). Right after a change, caching may still return the old records.

DNS provides no way to list DKIM selectors. If the scan finds nothing, check the DKIM-Signature header of a message you actually received.