Free tools · no signup
Free email authentication checker
Check SPF, DKIM and DMARC on any domain in one pass. This reads your live DNS and tells you in plain language which of the three are in place, which are broken, and what a receiving server does with your mail as a result.
Ungated · no email required · unlimited checks
In short
- This is a free, ungated email authentication checker. It reads the SPF, DKIM and DMARC records published in a domain's DNS and reports the state of all three in one result, with a link to a full report for each.
- The three records do different jobs. SPF lists the servers allowed to send mail for the domain. DKIM signs each message with a key only the sender holds, which is verified against a public key in DNS. DMARC reads the SPF and DKIM results, requires the domain that passed to align with the visible From domain, and tells receivers what to do when nothing does.
- Gmail, Yahoo and Microsoft all require bulk senders to have SPF, DKIM and DMARC configured. A DMARC policy of p=none blocks nothing, so a domain can publish all three records and still be unprotected.
- DNS provides no way to enumerate the selectors a domain uses for DKIM, so no checker can list every key on a domain. This tool probes the selectors used by common providers and reports only what it finds; supplying the selector on the DKIM checker gives a definitive answer.
- This summary is deliberately shallow. SmartReach.io publishes a dedicated free checker for each record that goes further: an SPF checker that follows the whole include tree and counts the ten-lookup budget, a DKIM checker that validates the key against RFC 6376, and a DMARC checker that reports the policy actually enforced and tests that the reporting addresses can receive anything.
Enter the domain your mail is sent from. We read its live DNS and report SPF, DKIM and DMARC in the order a receiving server evaluates them.
How the three fit together
Three records, read in this order
A receiving server does not weigh the three equally. It establishes whether the message authenticates at all, and only then applies the rule you published for the case where it does not. The order is why DMARC is the last one to turn on, not the first.
Who may send as you
A list of the servers allowed to send mail for your domain. The receiver checks the connecting server against it.
Proof the message is yours
A signature added to every message, verified against a public key in your DNS. It survives forwarding, which SPF does not.
What happens when both fail
The verdict on the other two, plus the rule receivers apply to mail that fails and the address your reports are sent to.
Publishing a strict DMARC policy before SPF and DKIM work tells the internet to reject your own mail. Get the first two passing, publish DMARC at p=none so the reports start arriving, then raise it.
Go deeper on one record
A full report for each of the three
The check above answers whether each record is in place. When one is not, these say exactly why: the whole include tree and its ten-lookup budget, the key at every selector we can reach, the policy receivers really apply and whether your reports arrive at all.
Which servers may send as you
SPF Checker
SPF lists the servers allowed to send mail for your domain. Check that yours is published, resolves, and stays under the ten-lookup limit that silently breaks it.
What it reads
v=spf1 include:_spf.google.com ~all
Proof the message is really yours
DKIM Checker
DKIM signs every message with a key only you hold. Check that the public key is published, parses, is not revoked, and is long enough to be trusted.
What it reads
v=DKIM1; k=rsa; p=MIIBIjANBgkq…
What happens when a check fails
DMARC Checker
DMARC tells receivers whether to quarantine or reject mail that fails SPF and DKIM, and where to send the reports. Check your policy, alignment and reporting address.
What it reads
v=DMARC1; p=reject; pct=100
Each tool checks its record against the specification that defines it: RFC 7208 for SPF, RFC 6376 for DKIM and RFC 7489for DMARC. Sender requirements are taken from each mailbox provider's own published rules, such as Google's sender guidelines. Last reviewed .
FREQUENTLY ASKED QUESTIONS
Email authentication, answered
Stop fixing deliverability one DNS record at a time.
SmartReach buys and authenticates your sending domains and mailboxes with SPF, DKIM and DMARC already in place, then warms them, rotates them, and verifies every address before you send.