SPF, DKIM & DMARC Checker
Verify your domain's email authentication in seconds — see exactly which protections are missing and how spoofers could exploit the gap.
Enter a domain above to check its SPF, DKIM, and DMARC records.
What Are SPF, DKIM, and DMARC?
These are three DNS-based standards that let receiving mail servers verify that an email actually came from your domain, rather than from someone spoofing it:
- SPF (Sender Policy Framework) — a DNS TXT record listing which mail servers are authorized to send email for your domain.
- DKIM (DomainKeys Identified Mail) — attaches a digital signature to outgoing mail, verified against a public key published in DNS, so receivers know the message wasn't altered in transit.
- DMARC (Domain-based Message Authentication, Reporting & Conformance) — the policy layer that ties SPF and DKIM together and tells receiving servers what to do when a message fails both: allow it, send it to spam, or reject it outright.
The Risks of Missing SPF, DKIM, and DMARC Records
Without these records, anyone can send an email that appears to come from your domain — a common technique in phishing, invoice fraud, and business email compromise (BEC) scams. The victim isn't your mail server; it's your customers, employees, and business partners who trust a message because it looks like it came from you.
US businesses lost over $2.9 billion to business email compromise in a single recent year according to FBI IC3 data, and a large share of those attacks rely on domains with no SPF, DKIM, or DMARC enforcement. Missing records don't just risk your own inbox — they let attackers impersonate you to everyone else.
Don't get blocked by Google and Yahoo. Both providers enforce strict email authentication requirements for bulk senders. Missing or misconfigured SPF, DKIM, or DMARC records will cause your legitimate marketing and transactional emails to be delayed, sent straight to spam, or rejected entirely.
How This Test Works
All checks run as live DNS lookups directly from your browser via Cloudflare's public DNS-over-HTTPS resolver:
- SPF — reads the TXT record at your domain root and evaluates the policy at the end of it ("-all", "~all", "?all", or "+all").
- DMARC — reads the TXT record at
_dmarc.yourdomain.comand evaluates its policy tag ("p=reject", "p=quarantine", or "p=none"). - DKIM — DKIM keys are published under a provider-chosen "selector" that isn't standardized, so this checks the selectors used by the largest mail providers (Google, Microsoft, Mailchimp, SendGrid, and others). A manual field lets you check a specific selector if you know it.
Understanding Your Results
| Result | What It Means |
|---|---|
| SPF — Configured (strict) | Record ends in "-all" — the strongest enforcement setting. |
| SPF — Soft fail / neutral | Record ends in "~all" or "?all" — some protection, but non-matching mail is often still delivered. |
| SPF — Missing / misconfigured | No record found, more than one record exists, or the record ends in "+all" (accepts any server). |
| DMARC — p=reject | Failing messages are rejected outright — the strongest policy. |
| DMARC — p=quarantine / p=none | Failing mail is sent to spam ("quarantine") or simply monitored with no action ("none"). |
| DMARC — Missing | No policy exists, so a failed SPF or DKIM check has no consequence. |
| DKIM — Found | A valid key was found under one of the common selectors checked. |
| DKIM — Not found (common selectors) | None of the common selectors matched — this does not confirm DKIM is missing, only that it's not under a commonly used name. |
How to Fix Missing Records
The Verdict: Missing Records Are an Open Door for Spoofers
SPF, DKIM, and DMARC cost nothing to set up — they're free DNS records, not a paid service — yet a large share of domains still run without them, leaving an easy opening for phishing and impersonation.
If any of the checks above came back missing or weak, treat it as a priority fix rather than a nice-to-have: it takes effect the moment the DNS record propagates.
Explore More Free Network & DNS Diagnostic ToolsFrequently Asked Questions
What are SPF, DKIM, and DMARC?
Why does my domain need all three?
Why didn't the DKIM check find my key?
google._domainkey.example.com), and that selector isn't standardized — it varies by mail provider and can even be customized. This tool automatically checks the selectors used by the largest providers, but a miss doesn't confirm DKIM is missing. If you know your provider's selector (check your email admin console), enter it manually in the DKIM result card to check it directly.