Free DNS Email-Security Check (SPF, DMARC, DKIM)

Free Free to use — no account needed.

Enter a domain to check how well it is protected against email spoofing. This reads the domain's SPF, DMARC, and MX records — and an optional DKIM selector — parses each for strictness, and gives you an overall anti-spoofing grade with specific fixes. It's free, instant, and uses only public DNS.

What this DNS security check shows

  • SPF — who may send the domain's email and how strictly (-all vs ~all vs none), explained mechanism-by-mechanism, plus a count of the DNS lookups it uses against the 10-lookup limit (exceed it and SPF silently fails).
  • DMARC — the full policy, not just p=: it also reads pct (how much mail the policy covers), rua (where reports go), and sp (the subdomain policy), each in plain language.
  • DKIM — the tool automatically probes a list of common selectors (Google, Microsoft, Zoho, Proton, and more) and reports which ones publish a signing key — no need to know your selector.
  • MX — the mail servers that receive the domain's email, with a sanity check for null MX and misconfigured hosts.
  • Deliverability verdict — a plain-language good / weak / at-risk read on whether your mail will authenticate cleanly and reach the inbox, alongside the anti-spoofing letter grade.

Run a check

Enter a domain like example.com. DKIM selectors are probed automatically; the optional selector field just lets you check a specific one first.


Frequently asked questions

What is SPF?
SPF (Sender Policy Framework) is a DNS record listing which servers may send email for your domain. Ending it in -all tells receivers to reject anyone not on the list; ~all only marks them as suspect.
What is DMARC and why does the policy matter?
DMARC ties SPF and DKIM back to the visible From address and tells receivers what to do with mail that fails: p=reject blocks it, p=quarantine sends it to spam, and p=none only watches. Only reject and quarantine actually stop spoofing.
What is a DKIM selector, and do I need to know mine?
DKIM signs your outgoing mail with a key published in DNS under a named "selector". You don't need to know yours — this tool probes a list of common provider selectors automatically and reports which resolve. To check a specific one, enter it in the optional field; you can find it in a sent message's DKIM-Signature header (the s= tag).
Does this send any email or touch the domain's servers?
No. It only reads public DNS records. It never sends mail and never connects to the domain's own servers.
My domain doesn't send email — do I still need these?
Yes. A parked or non-sending domain should publish v=spf1 -all and a DMARC p=reject policy so attackers can't spoof it either.