DNS / email authentication
DNS, SPF, DKIM and DMARC checker
Inspect the public records that control website resolution and mail authentication. DKIM lookup needs the selector used by your provider.
A / AAAAPublic address records
MX + NSMail and authority routing
SPF / DKIM / DMARCAuthentication records
Enter a domain to see its public DNS and email-authentication records.
How to interpret it
Presence is not the same as correctness.
One SPF record is expected at the sending domain. DMARC is queried at _dmarc.example.com. DKIM public keys are queried at selector._domainkey.example.com.
The checker reports public DNS answers. It cannot prove that a particular message passed alignment; inspect the message's Authentication-Results header for that.
- Multiple SPF records are an error condition
- A DKIM selector must match the signer
- DMARC evaluates alignment with the visible From domain
- DNS caches can retain old answers until TTL expiry
- MX presence alone does not prove successful delivery
Need the records corrected?
Send the domain, mail provider and one full message header with sensitive content removed.