SPF, DKIM and DMARC Checker
Free SPF, DKIM and DMARC checker. It counts SPF DNS lookups, finds the DMARC policy under RFC 9989, and reads DKIM key types and lengths.
Updated
A domain, a URL or an email address.
Options
The s= value of a DKIM-Signature header; up to 5.
Enter a domain name and select Check to read its SPF, DKIM and DMARC records.
What Is an SPF, DKIM and DMARC Checker?
The SPF, DKIM and DMARC checker reads a domain's email authentication records from DNS and checks them against the RFCs. It walks the SPF include tree and counts DNS lookups and void lookups, finds the DMARC policy with the RFC 9989 DNS Tree Walk, checks external report addresses under RFC 9990, and reads each DKIM key's type and length. With mail transport checks on, it also reads the MX, MTA-STS, TLS-RPT and BIMI records. The result grades the domain as protected, partly protected or not protected, and lists every check with the rule it comes from.
How to Use the SPF, DKIM and DMARC Checker
- Enter a domain name, such as example.com. A URL or an email address works too.
- To add DKIM selectors you know (the s= value in a message's DKIM-Signature header), open Options. Common selector names are tried as well.
- Select Check. The result grades the domain, names what needs fixing, and shows each record. The include tree, DMARC tags and selectors tried open on demand.
- Copy a record, or copy a link that runs the same check again.
How It Works
SPF. The checker reads the domain's SPF record and follows every include and redirect. RFC 7208 lets SPF evaluation use at most 10 terms that cause DNS lookups (include, a, mx, ptr, exists, and redirect), and asks for a limit of two void lookups, which are lookups that return no records. Going over either limit is a permerror. The %{i} macro stands for the sending IP address, so terms that use it, or another macro tied to a message, are counted but not looked up.
DMARC. RFC 9989 obsoletes RFC 7489 and replaces the Public Suffix List with a DNS Tree Walk. The checker queries _dmarc at the domain, then at each parent domain, with at most eight queries. The record at the domain applies first, then the record at its Organizational Domain, then the record at its public suffix domain. A subdomain that inherits a policy gets the sp tag, or the np tag when the subdomain does not exist in DNS.
Report addresses. When a rua address is outside the domain's Organizational Domain, RFC 9990 asks receivers to look for a TXT record at <domain>._report._dmarc.<report host>. Without one, receivers ignore that address.
DKIM. A DKIM key is published at <selector>._domainkey.<domain>, and the domain owner chooses the selector names. The checker tries the selectors you enter, then a list of common names. RFC 8301 requires RSA keys of at least 1024 bits, recommends 2048 bits, and bans rsa-sha1. RFC 8463 adds Ed25519 keys, marked k=ed25519.
Mail transport. A single MX record of "0 ." (null MX) says the domain accepts no email. An MTA-STS policy is read from https://mta-sts.<domain>/.well-known/mta-sts.txt, and redirects are not followed. In enforce mode, sending servers must not deliver to MX hosts the policy does not list.
DNS. Lookups go to Cloudflare's 1.1.1.1 resolver over DNS over HTTPS in wire format, which Cloudflare recommends for critical use. The resolver's AD flag shows that every record in an answer was validated with DNSSEC.
How the Grade Is Set
The checker applies these rules in order and stops at the first that fits.
| Grade | When |
|---|---|
| Accepts and sends no mail | Null MX, the SPF record v=spf1 -all, and a DMARC policy of reject. |
| Not protected | No DMARC record, a DMARC record receivers cannot use, no SPF record, an SPF permerror, or +all. |
| Incomplete | A DNS lookup for SPF or DMARC failed, so the grade cannot be set. Try again. |
| Partly protected | A DMARC policy of none or in test mode (t=y), no DKIM key of 2048 bits or Ed25519 for the selectors tried, or SPF ending in ?all or without all. |
| Protected | SPF ends in -all or ~all, the DMARC policy is quarantine or reject without t=y, and a DKIM key of at least 2048 bits or Ed25519 was found. |
What Each Result Means
| Result | Meaning |
|---|---|
| SPF -all | -all gives mail from other servers the result fail. |
| SPF ~all | ~all gives mail from other servers the result softfail. |
| SPF ?all or no all | The record ends without all or redirect, so mail from other servers gets the result neutral, which receivers treat like none. |
| SPF +all | +all matches every server and gives it an SPF pass for this domain. |
| DMARC p=none | With none, the domain owner offers no expression of preference for mail that fails DMARC. |
| DMARC p=quarantine | With quarantine, the domain owner considers mail that fails DMARC suspicious. |
| DMARC p=reject | With reject, the domain owner considers every failure a clear sign that the domain is not used validly. |
| Null MX | A single MX record of "0 ." (null MX) says this domain accepts no email. |
| MTA-STS enforce | In enforce mode, sending servers must not deliver to hosts that fail MX matching or certificate validation, or that lack STARTTLS. |
| MTA-STS testing | In testing mode, sending servers report policy failures but still deliver the message. |
| BIMI | BIMI needs a DMARC policy of quarantine applied to all mail, or reject. BIMI is an Internet-Draft with no formal standing in the IETF. |
| DNSSEC validated | Every answer was validated with DNSSEC by the resolver. |
| DNSSEC not validated | At least one answer was not validated with DNSSEC by the resolver. The zone may be unsigned. |
DMARC Tags (RFC 9989)
| Tag | Meaning |
|---|---|
| v | Version. Must be the first tag, with the value DMARC1. |
| p | Policy for the domain and its subdomains, unless sp or np says otherwise: none, quarantine or reject. |
| sp | Policy for existing subdomains of the Organizational Domain. |
| np | Policy for subdomains that do not exist. Without np, sp applies, and without sp, p applies. |
| psd | y marks a public suffix domain. n marks the Organizational Domain for itself and its subdomains. |
| t | Test mode. With y, receivers apply one level less: quarantine instead of reject, none instead of quarantine. |
| adkim | DKIM alignment mode: r (relaxed, the default) or s (strict). |
| aspf | SPF alignment mode: r (relaxed, the default) or s (strict). |
| fo | Failure report options. Ignored when there is no ruf tag. |
| rua | Addresses for aggregate reports. Without rua, receivers send none. |
| ruf | Addresses for message-specific failure reports. |
| pct | Percentage of failing mail the policy applied to. Removed in RFC 9989. |
| rf | Format of failure reports. Removed in RFC 9989. |
| ri | Requested interval between aggregate reports. Removed in RFC 9989. |
Standards
Scope
What It Checks
- +Walks the SPF include and redirect tree and counts DNS lookups and void lookups against the RFC 7208 limits.
- +Expands %{d} and %{o} macros and marks terms that need a sending IP as not evaluated, without querying them.
- +Finds the DMARC policy with the RFC 9989 DNS Tree Walk, including the Organizational Domain and the sp and np tags.
- +Checks external DMARC report addresses for an RFC 9990 authorization record.
- +Reads DKIM keys for your selectors and common selector names, with key type, RSA key length, and revoked keys.
- +Reads MX, null MX, MTA-STS (record and policy file), TLS-RPT and BIMI records.
- +Shows whether the DNS answers were validated with DNSSEC.
What It Does Not Check
- -It does not send or receive email, and it does not test a message against these records.
- -It does not list every DKIM selector a domain uses, because DNS cannot list them.
- -It does not resolve the addresses behind mx and a terms for an IP match, because there is no sending IP.
- -It does not use the Public Suffix List.
- -It does not fetch BIMI logos or certificates.
Defensive Use
SPF and DKIM let a receiving server check that mail using a domain comes from servers or signing keys its owner authorized, and DMARC tells receivers what to do with mail that fails. Under a DMARC policy of reject, the domain owner considers every failure a clear sign that the domain is used without permission. For domains that send no mail, the UK NCSC recommends an SPF record with no permitted senders.
Frequently Asked Questions
What is an SPF, DKIM and DMARC Checker?→
The SPF, DKIM and DMARC checker reads a domain's email authentication records from DNS and checks them against the RFCs. It walks the SPF include tree and counts DNS lookups and void lookups, finds the DMARC policy with the RFC 9989 DNS Tree Walk, checks external report addresses under RFC 9990, and reads each DKIM key's type and length. With mail transport checks on, it also reads the MX, MTA-STS, TLS-RPT and BIMI records. The result grades the domain as protected, partly protected or not protected, and lists every check with the rule it comes from.
What is the SPF, DKIM and DMARC Checker used for?→
Checking a domain's SPF, DKIM and DMARC records after a change of mail provider, finding why SPF fails with too many DNS lookups, and confirming that a DMARC policy of quarantine or reject applies to a domain and its subdomains.
Is my data sent anywhere?→
The SPF, DKIM and DMARC Checker sends the domain name and DKIM selectors you enter to ImmunitySec servers, which run the check and return the result. To run it, they contact Cloudflare's public DNS resolver over DNS over HTTPS and, when the MX, MTA-STS, TLS-RPT and BIMI checks are on, the domain's MTA-STS policy host. Nothing else you enter leaves the page.
How is the SPF, DKIM and DMARC Checker used defensively?→
SPF and DKIM let a receiving server check that mail using a domain comes from servers or signing keys its owner authorized, and DMARC tells receivers what to do with mail that fails. Under a DMARC policy of reject, the domain owner considers every failure a clear sign that the domain is used without permission. For domains that send no mail, the UK NCSC recommends an SPF record with no permitted senders.
Why does SPF fail with too many DNS lookups?→
RFC 7208 lets SPF evaluation use at most 10 terms that cause DNS lookups: include, a, mx, ptr, exists, and the redirect modifier. Terms inside included records count toward the same total. When a record needs more than 10, receivers must return permerror.
What changed for DMARC in RFC 9989?→
RFC 9989 obsoletes RFC 7489. It removes the pct, rf and ri tags, adds the np, psd and t tags, and finds the Organizational Domain with a DNS Tree Walk instead of the Public Suffix List.
Why does the checker not find my DKIM key?→
The domain owner picks the selector names, and a DKIM key is published at <selector>._domainkey.<domain>. DNS cannot list the selectors under a domain, so enter the s= value from the DKIM-Signature header of a message the domain sent.
What does a DMARC policy of none do?→
With p=none, the domain owner offers no expression of preference for mail that fails DMARC. A rua tag still asks receivers to send aggregate reports to the listed addresses.