SPF
Sender Policy Framework
SPF summary goes here.
Email Security Checker
Analyze SPF, DKIM, and DMARC records for your domain. Ensure your email infrastructure is secure and properly configured.
Email Authentication Audit
Check whether your domain is ready to prevent spoofing, improve deliverability, and build sender trust.
This tool inspects your SPF, DKIM, and DMARC setup, highlights weak spots, and shows exactly what needs improvement.
SPF
Authorized senders and envelope policy
DKIM
Selector discovery and key strength review
DMARC
Policy, reporting, and enforcement posture
What you get
- Fast SPF, DKIM, and DMARC inspection
- Readable findings and raw DNS records
- Clear next-step recommendations
Good to know
DKIM often needs the exact selector to verify conclusively. If you do not know it, the checker will still inspect SPF and DMARC and mark DKIM carefully instead of guessing.
Run analysis
Enter a domain and optionally a DKIM selector to run a more accurate email security scan.
Tip: enter only the root domain, e.g. example.com
Improves DKIM accuracy
If you know the selector from your email provider, enter it here. Otherwise leave it empty.
Quick domains
No analysis yet
Run a scan to review SPF, DKIM, and DMARC records, detect weak configurations, and get practical recommendations.
SPF inspection
Authorized senders, policy style, syntax checks
DKIM discovery
Common selector lookup, key analysis, selector hints
DMARC policy audit
Policy, reporting, alignment, rollout guidance
Analysis Overview
example.com
Email security summary will appear here.
Overall score
0
Out of 100
Checks passed
0/3
SPF / DKIM / DMARC
Latency
0ms
API processing time
Security Grade
Calculated from record health
A
DKIM
DomainKeys Identified Mail
DKIM summary goes here.
DMARC
Policy & reporting
DMARC summary goes here.
Recommendations
result.log
Learn more & FAQ
What does the email security check cover?
SPF, DKIM, and DMARC each protect a different part of email authentication, and a weakness in any one of them undermines the others. This tool checks all three for your domain in a single pass and gives you an overall picture - rather than needing to run three separate lookups and piece the results together yourself.
How to read your results
Each of SPF, DKIM, and DMARC gets its own status along with the specific issue found, if any. A domain with all three correctly configured and a DMARC policy enforcing (quarantine or reject) is in the strongest position against spoofing and has the best chance of its own mail reaching inboxes rather than spam folders.
Frequently asked questions
What's checked in a full email security check?
This tool checks all three authentication records together - SPF (which servers can send for your domain), DKIM (message signing), and DMARC (the policy for handling failures) - and reports whether each is present, correctly formatted, and working as intended.
Why check all three instead of just one?
They work together, not independently - a strong DMARC policy is only effective if the underlying SPF and DKIM records it relies on are actually correct, and a missing DMARC record means even perfect SPF and DKIM provide no enforcement. Checking them as a set catches gaps a single-record check would miss.
My SPF record looks fine - why does the overall check still show an issue?
A single record being syntactically valid doesn't mean the overall setup is complete - common gaps include an SPF record that doesn't include a service you actually send through, a DKIM selector mismatch, or a DMARC record with no enforcement policy set.
Will fixing these records guarantee my email reaches the inbox?
No single fix guarantees inbox placement - sender reputation, content, and recipient engagement all factor in too. But a broken or missing SPF/DKIM/DMARC setup is one of the most common reasons otherwise-legitimate mail gets filtered, so fixing it removes a major, easily avoidable obstacle.
How often should I re-run this check?
Re-run it after any change to your mail provider, sending infrastructure, or DNS, and periodically otherwise - records can silently break if a provider changes its required SPF entries or a DNS edit elsewhere accidentally overwrites one of these.