Enter any domain to see its MX, SPF, DKIM, and DMARC records — and a plain-English explanation of what is misconfigured. Free, no signup.
SPF publishes which servers are allowed to send email as your domain. DKIM adds a cryptographic signature so a receiver can confirm the message was not altered in transit and genuinely came from an authorised sender. DMARC ties the two together and tells receiving servers what to do when a message fails both — and sends you reports on who is trying to spoof you.
DKIM selectors are arbitrary strings chosen by your email provider, so no tool can enumerate them all. This checker probes the most common defaults. If your provider uses a custom selector, the key exists at that name even though this lookup did not find it — check your provider dashboard for the selector it signs with.
SPF alone is rarely enough. The most common causes are a missing DMARC record, a missing or unverified DKIM signature, more than one SPF record on the domain (which makes receivers ignore SPF entirely), or a domain with no sending history. Sender reputation and content matter too — authentication gets you eligible for the inbox, it does not guarantee placement.
It is free with no signup. Lookups are rate limited per IP to keep the service available, and the results are generated live from public DNS each time you run a check. The records this tool reads are public — anyone can query them.
These are DMARC policies. p=none monitors only and changes nothing, which is the correct place to start. p=quarantine asks receivers to send failing mail to spam. p=reject asks them to refuse it outright. Move up gradually — jumping to reject before your legitimate sending sources are all authenticated will silently block your own mail.