SPF, DKIM & DMARC Checker — IT Ops Tools

Check SPF, DKIM & DMARC

SPF record generator

Includes (one per line, e.g. _spf.google.com)

IPv4 addresses / ranges (one per line)

IPv6 addresses / ranges (one per line)

Authorise the domain's own A/AAAA (a) Authorise the domain's MX hosts (mx)

Policy for all other senders

Generated SPF record (TXT at the root domain)

v=spf1 ~all

DMARC record generator

Policy (p)

Apply to % of mail (pct)

Aggregate report address (rua)

Forensic report address (ruf) — optional

SPF alignment (aspf)

DKIM alignment (adkim)

Generated DMARC record (TXT at _dmarc.yourdomain)

v=DMARC1; p=none; pct=100; adkim=r; aspf=r

DKIM

DKIM keys are generated by your mail provider (Google Workspace, Microsoft 365, SendGrid, etc.), which gives you a selector and a public key to publish as a TXT record at selector._domainkey.yourdomain. There is nothing to generate here — enable DKIM in your provider's admin console, then use the checker tab to confirm the published record validates.

How the SPF, DKIM & DMARC checker works

Three layers of email authentication, validated in your browser over DNS-over-HTTPS — with the exact misconfigurations that hurt deliverability called out.

SPF validation

Finds your v=spf1 record, counts the DNS-querying mechanisms against the limit of 10 (over which SPF returns permerror), and flags risky settings like +all, multiple SPF records, or a missing all qualifier.

DKIM probing

Checks selector._domainkey for a valid v=DKIM1 public key across a list of common selectors used by major providers, plus any selector you supply — and warns on revoked (empty p=) keys.

DMARC policy review

Reads _dmarc, parses the policy and reporting tags, and explains what each means — flagging a p=none that offers no protection, a missing rua so you get no reports, or a pct below 100.

Record generators

Build a syntactically correct SPF record (with a live count of DNS lookups) and a DMARC record tuned to your rollout stage, then copy them straight into your DNS zone.

Deliverability focused

The checks map directly to why mail lands in spam under the 2024 Gmail and Yahoo sender rules — authentication, alignment, and a DMARC policy — so you can fix the causes, not the symptoms.

Client-side over DoH

All lookups run from your browser over encrypted DNS-over-HTTPS and the generators are pure JavaScript — nothing you type is logged or stored on our servers.

Frequently asked questions

What do SPF, DKIM and DMARC do?

SPF lists which servers may send mail for your domain, DKIM cryptographically signs your messages so receivers can verify they were not altered, and DMARC ties the two together — telling receivers what to do when a message fails authentication and where to send reports. Together they prove your mail is genuine and stop attackers spoofing your domain.

Why is my email going to spam even though I have SPF?

SPF alone is often not enough. Common causes are a missing or "p=none" DMARC policy, no DKIM signing, an SPF record with too many DNS lookups (over the limit of 10 it returns permerror), a "+all" that authorises everyone, or more than one SPF record on the domain. This checker flags each of these.

What is a DKIM selector and why do I need one?

DKIM keys are published at "selector._domainkey.yourdomain", where the selector is chosen by your mail provider (for example "google", "selector1", or "k1"). There is no way to discover selectors from DNS alone, so the checker probes a list of common selectors and lets you enter your own if you know it.

What DMARC policy should I use?

Start at "p=none" with a "rua" reporting address to gather data without affecting delivery, review the aggregate reports until legitimate mail passes, then move to "p=quarantine" and finally "p=reject" for full protection against spoofing. Raising the policy too early can cause legitimate mail to be quarantined.

Is this tool free and private?

Yes. All lookups run in your browser over encrypted DNS-over-HTTPS and the generators are entirely client-side, so the domains you check and the records you build are never sent to or stored on our servers.