Check your domain’s SPF, DKIM and DMARC
See whether email that claims to come from your domain can be checked by the servers that receive it, and what to fix first. It reads public DNS records only, takes a few seconds, and stores nothing.
Enter your domain
Use the part after the @ in your email address, such as example.com.
This checks public DNS records only. A pass means a record is present and valid; it doesn’t guarantee your email reaches the inbox or that your domain can’t be spoofed. We don’t store the domains you check.
Four records, in plain language
SPF
A list of the servers allowed to send email for your domain. There should be exactly one SPF record, it should end with “-all” or “~all”, and it must stay within 10 DNS lookups or receivers treat it as broken.
DKIM
A digital signature your email provider adds to each message, checked against a public key in your DNS. Each provider that sends for you, such as your mailbox, CRM or marketing platform, needs its own key.
DMARC
Tells receivers what to do with email that fails SPF and DKIM: nothing (none), send to spam (quarantine) or refuse it (reject). It also sends you reports showing who sends email as your domain.
MX
Says which servers receive email for your domain. A domain that never sends or receives email should say so, with a null MX, SPF “-all” and DMARC reject, so it can’t be used in fake emails.
The usual order of fixes
Fix it yourself
- List every service that sends email as your domain
- One SPF record covering them, ending in -all or ~all
- DKIM turned on with each of them
- DMARC at p=none with a reports address
- Quarantine, then reject, once reports are clean
Or have us do it
Our phishing and account abuse work includes email domain hardening: SPF, DKIM and DMARC set up and moved to enforcement step by step, alongside phishing training and protection for your sign-in and OTP flows.
Phishing & account abuseCommon questions about email security
Why do SPF, DKIM and DMARC matter now?
They let receiving mail servers check that email claiming to come from your domain really does, which makes your domain harder to impersonate. Large mailbox providers now expect them: since February 2024, Google requires every sender to use SPF or DKIM, and senders of 5,000 or more messages a day to Gmail accounts to have SPF, DKIM and DMARC. Yahoo has similar rules for bulk senders.
Why can’t the checker find our DKIM key?
Each DKIM key sits under a name chosen by your email provider, called a selector, and DNS has no way to list them. The checker tries the most common names. If yours isn’t found, look for the selector in your email provider’s DKIM settings, or in the s= value of the DKIM-Signature header of an email you sent, and enter it in the optional box.
Is it safe to move DMARC to reject?
Only once your reports show that every service sending email as your domain passes, such as your mailbox provider, CRM, marketing platform and billing system. Start at p=none with a reports address, fix the senders that fail, move to quarantine, then reject. Moving too early can send genuine invoices or password resets to spam.
What does the checker store?
Nothing. The domain you enter is sent to our server, which looks up its public DNS records through Cloudflare’s public DNS resolver and returns the results. We don’t save the domain or the results, and our analytics records only how many checks passed, warned or failed. Results are cached for five minutes so repeat checks are quick.
Sources: SPF: RFC 7208 · DKIM: RFC 6376 · DMARC: RFC 9989 (2026, replaces RFC 7489) · Google: email sender guidelines · Yahoo: sender best practices · UK NCSC: email security and anti-spoofing.
Want a second pair of eyes on the results?
Send us what the checker found. We’ll tell you what to fix first and how to move to enforcement without losing genuine email — and if your setup is already in good shape, we’ll say that.