SPF / DKIM / DMARC
Generate SPF and DMARC records and validate SPF, DKIM, and DMARC. Improve email deliverability and protect against spoofing.
What we validate
SPF
Checks if SPF record exists, is the only one (RFC 7208), and ends with a proper 'all' mechanism for unauthorized senders.
DKIM
Verifies DKIM record exists for the specified selector and contains a valid public key for email signature verification.
DMARC
Checks DMARC record at _dmarc subdomain, validates policy (none/quarantine/reject), and reports aggregate/forensic email settings.
Validation Results
Email Authentication Score
Generated TXT Record
Add this as a TXT record for
Other DNS Tools
DNS Lookup
Query DNS records for any domain. Check A, AAAA, MX, CNAME, TXT, NS, SOA, SRV, CAA, and PTR records.
DNS Propagation Checker
Check if DNS changes have propagated across global DNS servers. Verify updates from Google, Cloudflare, OpenDNS, and more.
WHOIS Lookup
Look up domain registration information. Find registrar, creation date, expiry date, nameservers, and contact details.
SSL Certificate Checker
Inspect SSL/TLS certificates. Check issuer, validity dates, subject alternative names, and certificate chain.
Blacklist Check
Check if an IP address or domain is listed on DNS-based blacklists (DNSBL). Test against Spamhaus, Barracuda, SpamCop, and more.
DNS Health Check
Run a comprehensive DNS health check on your domain. Analyze nameservers, SOA, MX, web records, and email authentication.
Frequently Asked Questions
-
SPF (Sender Policy Framework) specifies which servers can send email for your domain. DKIM (DomainKeys Identified Mail) adds a digital signature. DMARC (Domain-based Message Authentication) tells receivers what to do with emails that fail SPF/DKIM checks.
-
Without SPF, DKIM, and DMARC, anyone can send emails pretending to be from your domain (email spoofing). These records protect your domain reputation and improve email deliverability.
-
The DKIM selector depends on your email provider. Common selectors include 'default', 'google', 'selector1', 's1', or 'k1'. Check your email provider’s documentation for the correct selector.
-
Common SPF issues: missing 'v=spf1' prefix, too many DNS lookups (max 10), multiple SPF records (only one allowed), or missing 'all' mechanism. Use the validator to identify the problem, then update the TXT record at your DNS provider.
-
Missing or misconfigured SPF, DKIM, or DMARC records are the most common cause. Validate all three with this tool. Also check that your sending IP is not on any blacklists and that your DMARC policy is not set to 'none'.
-
Hard fail (-all) tells receivers to reject emails from unauthorized servers. Soft fail (~all) marks them as suspicious but still delivers them. Start with soft fail while testing, then switch to hard fail once you’ve confirmed all legitimate senders are included.