SPF DKIM DMARC Checker
Audit and validate SPF, DKIM, and DMARC DNS records to prevent email spoofing and improve domain deliverability. Supports live DoH queries or manual record parsing.
Interactive Workbench
Real-time processing directly in your browser.
Browser-Native SPF, DKIM, and DMARC Email Authentication Audit
The SPF DKIM DMARC Checker performs comprehensive validation of DNS email authentication records. Operating directly in your browser, system administrators, security auditors, and deliverability specialists can verify domain alignment, detect syntax errors, and audit email security posture without transmitting private domain configurations to third-party databases.
This tool evaluates Sender Policy Framework (SPF) TXT records for lookup limits and mechanism validity, DomainKeys Identified Mail (DKIM) selector records for public key presence, and Domain-based Message Authentication, Reporting, and Conformance (DMARC) policies for enforcement strength (p=reject, quarantine, or none) and aggregate reporting URIs.
Featuring both live DNS-over-HTTPS (DoH) domain lookups and a manual record string parser, the workspace provides clear security ratings, syntax warnings, and actionable recommendations to help prevent email spoofing, phishing abuse, and domain impersonation.
Core Tool Capabilities
- SPF Mechanism and Lookup Analysis: Parses SPF mechanisms (ip4, ip6, a, mx, include, redirect) and calculates DNS lookup counts to ensure compliance with the RFC 7208 10-lookup limit.
- DKIM Selector Key Inspection: Audits DKIM selector TXT records to confirm public key presence, algorithm type, and key revocation status.
- DMARC Policy Enforcement Evaluation: Evaluates DMARC enforcement policies (p=reject, quarantine, none), alignment modes (adkim, aspf), percentage tags, and aggregate reporting (rua) configurations.
- Live DoH & Manual Record Parsing: Supports live domain queries via DNS-over-HTTPS as well as manual record string parsing for offline or pre-deployment validation.
Local Browser Privacy
Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.
Once the page has loaded, you can disconnect your network connection and continue using this tool offline.
Target Use Cases
- • Domain Anti-Spoofing and Phishing Prevention
- • Mail Server Migration and Onboarding
- • Email Deliverability Optimization
- • Compliance and Security Audits
Technical Specifications & Platform Limits
Official IETF email authentication standards.
Direct encrypted DNS queries with zero tracking.
Full DNS record scope for email security.
Local parsing with zero server storage or telemetry.
Step-by-Step Workflow
Enter Target Domain Name
Type the target domain name (e.g. example.com) and optional DKIM selector (e.g. google or default).
Execute Live DNS Audit
Click Audit Domain Records to fetch live SPF, DKIM, and DMARC TXT records via DNS-over-HTTPS.
Inspect Parsed Tags and Ratings
Review detailed tag breakdowns, alignment directives, lookup counts, and overall security ratings.
Review Security Warnings
Check for permissive directives (p=none, +all) and follow remediation guidance to harden domain security.
Practical Real-World Use Cases
Domain Anti-Spoofing and Phishing Prevention
Security teams auditing domain records to enforce strict DMARC policies and block unauthorized phishing emails.
Mail Server Migration and Onboarding
System engineers validating new email service provider SPF includes and DKIM selectors during mail server migration.
Email Deliverability Optimization
Marketing and deliverability specialists verifying authentication alignment to improve inbox placement rates.
Compliance and Security Audits
IT auditors evaluating domain security controls against industry benchmarks and transport security guidelines.
Frequently Asked Questions
- Why is a strict DMARC policy (p=reject) necessary?
- A policy of p=reject instructs receiving mail servers to drop unauthenticated email attempts completely, preventing spoofers from impersonating your domain.
- What is the SPF 10-lookup limit?
- RFC 7208 limits the number of DNS queries performed during SPF evaluation to 10 to prevent Denial of Service amplification attacks. Exceeding this limit causes SPF evaluation to fail.
- How do I find my DKIM selector?
- DKIM selectors are defined by your email service provider (e.g., google for Google Workspace, s1 for Microsoft 365). Look in your mail admin console for the prefix before ._domainkey.
- What is the difference between relaxed and strict alignment in DMARC?
- Relaxed alignment allows organizational subdomains to match the From domain, whereas strict alignment requires an exact hostname match for both SPF (aspf=s) and DKIM (adkim=s).
- Does parsing a pasted record make network requests?
- No. The manual record parser executes 100% locally within your browser using deterministic regex and token parsing without dispatching any DNS or network queries.
Share this tool
Help others discover this utility. No login or registration required.
Master this tool with Guides & Articles
Learn the workflows, common mistakes, and advanced techniques behind SPF DKIM DMARC Checker - Email Authentication DNS Audit with our deep-dive educational content.