Free SPF, DKIM & DMARC Checker
Enter any domain to see its email authentication records, the DMARC policy in force, how many of the ten permitted SPF lookups are used, and what is missing. No signup, no email required.
Free, no signup. Queries public DNS records only — nothing is sent to your domain and no results are stored.
What each record does
SPF publishes the list of servers permitted to send mail using your domain. A receiving server checks whether the message\u2019s source appears on that list. You may only publish one SPF record, and evaluating it may cost at most ten DNS lookups \u2014 exceed either limit and the whole record fails.
DKIM attaches a cryptographic signature to each message. Your server signs with a private key; the matching public key sits in DNS at a selector subdomain. Because the signature travels with the message, DKIM survives forwarding where SPF does not.
DMARC is the policy layer. It requires that SPF or DKIM not merely pass but align with the domain your recipient actually sees, tells receivers what to do on failure, and asks them to send you reports.
Why DKIM may show as not found
DKIM keys live at a selector subdomain, and there is no way to enumerate selectors from DNS \u2014 you have to know the name to query it. This tool tries the selectors used by the major providers and sending platforms, which covers most real domains. If yours uses a custom selector, DKIM may be configured correctly and still show as not found here. Check the raw message headers of an email you have sent to confirm.
About this checker.
What it queries, what it cannot see, and how to read the results.
Is this SPF, DKIM and DMARC checker really free?
Yes. No signup, no email address, and no limit beyond a rate limit to stop automated abuse. It queries public DNS records, which anyone can look up — we have simply made the output readable and explained what each finding means.
Why does DKIM show as not found when I know it is configured?
DKIM public keys live at a selector subdomain, and selectors cannot be enumerated from DNS — you have to know the exact name to query it. This tool tries the selectors used by the major providers and sending platforms, which covers most domains. If yours uses a custom selector, DKIM can be working correctly and still show as not found here. Check the DKIM-Signature header on a message you have sent to see your real selector.
What is a good authentication score?
Anything at 85 or above means SPF, DKIM and DMARC are all present with no serious misconfiguration. Below 60 usually means a record is missing entirely. The score is a summary of the findings below it — those are the part worth reading, because they say specifically what to change.
Does passing all three guarantee my email reaches the inbox?
No. Authentication removes a reason to filter you; it does not create a reason to trust you. Sending volume per mailbox, pacing, recipient engagement and complaint rate decide the rest. What authentication does guarantee is that failing it will hurt you — Google and Yahoo both require it from bulk senders.
Do you store the domains I check?
No. The lookup runs, the result returns, and nothing is retained.
Records failing? We check them on every domain you add.
Email.biz.pk runs these same lookups when you connect a sending domain, so authentication problems surface before your first campaign rather than after it.
Start Free Trial