Email Authentication Checker
Email authentication checker — SPF, DMARC, DKIM selectors, and MX records with a deliverability verdict.
About this tool
Mail providers validate SPF, DMARC, and DKIM before accepting messages. This tool reads your domain's DNS and reports policy mode, missing records, and common misconfigurations that cause bounces, spoofing risk, or spam-folder placement.
What you get
- Pass, warn, or fail verdict with an issues list
- SPF TXT record with syntax and lookup-limit hints
- DMARC policy at _dmarc (none, quarantine, reject) with alignment notes
- DKIM public keys for common selectors (Google, Microsoft, SendGrid, and others)
- MX hosts sorted by priority for inbound mail routing
How to use
Enter the domain that sends or receives mail for your organization. If no DKIM selector is found, your provider may use a custom name — check their documentation.
Example email authentication verdict
For a domain with Google Workspace and strict DMARC, you might see:
| Check | Result |
|---|---|
| SPF | Pass — authorized sending IPs found |
| DMARC | Pass — policy p=reject, alignment OK |
| DKIM (selector google) | Pass — valid signature |
| MX | aspmx.l.google.com (priority 1) |
Selectors vary by provider; the tool tests common selectors automatically.
Glossary
- SPF
- Sender Policy Framework — DNS TXT listing hosts allowed to send mail for the domain.
- DMARC
- Policy telling receivers how to handle mail that fails SPF/DKIM alignment.
- DKIM
- DomainKeys Identified Mail — cryptographic signature on outbound messages.
- Alignment
- Whether the From domain matches the SPF or DKIM signing domain.
FAQ
How to check SPF record for a domain?
Enter the domain to fetch and parse the SPF TXT record, list authorized senders, and read whether the policy validates cleanly.
How to verify DMARC policy for email?
The check reads the _dmarc TXT record and reports policy mode (none, quarantine, reject), alignment hints, and configuration issues.
How to test DKIM configuration online?
Common selector names are tried automatically; published public keys and signature readiness are summarized with any problems found.
Why is my email going to spam—SPF or DMARC?
The verdict highlights SPF fail, missing DMARC, or DKIM problems that receivers use to filter or reject mail—fix these before chasing content issues.
How to check MX records with SPF and DMARC?
One run returns MX hosts plus SPF, DMARC, and DKIM selectors so you can validate the full outbound and inbound mail setup.
What email authentication records should a domain have?
At minimum a correct SPF TXT, working DKIM signatures on outbound mail, and a published DMARC policy—MX must point to live mail servers.
By using this tool you agree to our Terms of Use and Privacy Policy. Results are provided as-is without warranty.