Free SPF, DMARC and DKIM checker
SPF, DMARC and DKIM tell mail servers which email really comes from your domain. Without them, anyone can send email that looks like it's from you. This check only reads public DNS records.
What this checks
- SPF: whether your domain has a
v=spf1record, and whether it ends in+all, which lets any server send as you. - DMARC: whether
_dmarc.your-domainhas av=DMARC1record, and whether its policy is only monitoring (p=none) or enforced (quarantineorreject). - DKIM: whether a DKIM key exists on 8 common selectors (google, default, selector1, selector2, k1, s1, resend, mail).
- MX: whether the domain receives email, which changes how serious a missing record is. A domain that never sends mail can still be spoofed.
What it can't tell you
- It checks your main domain (for
app.your-domain.comit checksyour-domain.com). Shared hosting addresses likeyour-app.vercel.appare skipped because their records belong to the host. - DKIM keys can only be found on a known selector. Not finding one on our list doesn't mean you don't have DKIM.
- It doesn't send email, check SPF's 10-lookup limit or read your DMARC reports.
- No issues found is never proof that your email can't be spoofed.
Check it yourself
From a terminal, using your own domain:
dig +short TXT your-domain.com | grep spf1 dig +short TXT _dmarc.your-domain.com dig +short TXT google._domainkey.your-domain.com
On Windows, use nslookup -type=TXT _dmarc.your-domain.com.
How to fix it
- Add one SPF TXT record listing the services that send your email, ending in
~allor-all. If the domain never sends mail, usev=spf1 -all. - Turn on DKIM in each email service you use (Google Workspace, Microsoft 365, Resend and others give you the records to add).
- Add a DMARC record at
_dmarc, start withp=noneand a report address, then move top=quarantineandp=rejectonce your real email passes.
This checker answers one question. The free scan checks everything at once, and how our scanner works explains what it does and never does.
Questions
Do I need these if I don't send email from my domain?
Yes, a minimal version. v=spf1 -all and a DMARC record with p=reject tell mail servers your domain never sends email, so spoofed messages get rejected.
Why is p=none flagged?
p=none only collects reports. Mail servers still deliver spoofed email. It's the right first step, but move to quarantine or reject once your real email passes.
Why was my site skipped?
Shared addresses like your-app.lovable.app or your-app.vercel.app belong to the hosting company, so you can't set their email records. Check your own domain once you have one.
Does this send any email?
No. It only makes public DNS lookups.