DevFlow logoDevFlow

DMARC, SPF & DKIM Checker and Record Generator — Free

DMARC, SPF & DKIM Checker

Check DMARC, SPF & DKIM records for any domain, get an authentication score, and generate SPF/DMARC records.

Free DMARC, SPF & DKIM checker with an interactive score. Enter any domain to validate its DMARC policy, SPF record (with a live DNS lookup counter against the RFC 7208 limit of 10), and DKIM public keys probed across 24+ common selectors and any custom selectors you supply. Includes an organizational-domain DMARC fallback check per RFC 7489, MX record listing, plain-English explanations of every issue, and a shareable score summary. The Generate tab builds ready-to-publish SPF and DMARC TXT records with live lookup-count estimates — everything you need to pass Gmail and Yahoo bulk sender requirements.

Keywords: dmarc checker, dmarc lookup, spf record checker, spf record generator, dkim checker, dkim validator, dmarc record generator, spf lookup limit, email authentication checker, pass gmail dmarc requirements, yahoo bulk sender requirements, gmail bulk sender requirements, spf 10 lookup limit, dmarc policy checker, email spoofing check

Tags: dmarc, spf, dkim, email, authentication, dns, txt record, email security, spoofing

Popular Network tools

Browse all 11 Network tools →

DMARC, SPF & DKIM Checker is also known as: DMARC Lookup, SPF Checker, DKIM Checker, Email Authentication Checker, DMARC Record Generator.

How to DMARC, SPF & DKIM Checker Online

  1. Enter the domain you want to audit (e.g., yourdomain.com) in the input field on the Check tab.

  2. Optionally add DKIM selectors (comma-separated) — the tool automatically probes 24+ common selectors like google, selector1, s1, and k1 on top of yours.

  3. Press ⌘↵ or click Check. The tool queries SPF, DMARC, DKIM, and MX records in parallel and scores the domain out of 100.

  4. Read the score card and per-record issues: the SPF lookup counter, DMARC tag table, and DKIM probe results explain exactly what to fix.

  5. Switch to the Generate tab to build corrected SPF and DMARC records with live lookup-count estimates, then publish them as TXT records.

DMARC, SPF & DKIM Checker Features

  • All-in-one email authentication check: DMARC, SPF, DKIM, and MX records queried in parallel for any domain.

  • Prominent SPF DNS lookup counter: see exactly how many of the 10 allowed lookups (RFC 7208) an SPF record consumes — green ≤7, amber 8–9, red >10. Most checkers bury this.

  • DKIM selector probing: automatically checks 24+ common selectors (google, selector1, selector2, s1, s2, k1, zoho, protonmail, sendgrid, mandrill, and more) plus any custom selectors you enter.

  • Shareable score summary: one click copies a plain-text A–F graded report you can paste into a ticket, email, or audit.

  • SPF Record Builder: interactive generator for ip4/ip6 lists, includes, a/mx mechanisms, and all-mechanism choice with a live lookup-count estimate that warns before you break the 10-lookup limit.

  • DMARC Record Generator: build records with p/sp policies, pct, adkim/aspf alignment, and rua/ruf report addresses — assembled live as you configure.

  • Plain-English issue explanations: every warning explains what it means and how to fix it, from "+all is dangerous" to "p=none is monitor-only".

  • Organizational-domain DMARC fallback: checks the parent domain’s _dmarc record per RFC 7489 when a subdomain has none, and flags the inheritance.

  • Full DMARC tag parsing: p, sp, rua, ruf, pct, adkim, aspf, fo, rf, and ri are validated and displayed in a readable table.

  • SPF mechanism breakdown: qualifier, mechanism, and value for every token, with lookup-contributing mechanisms marked.

  • Gmail & Yahoo bulk sender compliance: built around the 2024+ requirements — SPF+DKIM alignment and at least p=none DMARC with reporting.

  • MX record listing: mail exchangers with priorities, so you can spot missing or misconfigured mail setup at a glance.

  • Copy everything: SPF records, DMARC records, and the full score summary each have one-click copy.

  • Recent check history: your last 10 checks are saved locally for quick re-runs; nothing is stored server-side.

Supported SQL Dialects

The DMARC, SPF & DKIM Checker supports 8 SQL dialects. Select the right dialect for accurate formatting and keyword recognition.

SPF (Sender Policy Framework)
A TXT record starting with v=spf1 that lists the servers allowed to send mail for a domain. Evaluated against a hard limit of 10 DNS lookups (RFC 7208).
DKIM (DomainKeys Identified Mail)
Cryptographic signatures on outgoing mail, verified against a public key published at <selector>._domainkey.<domain>. The selector is the label chosen by the sending system.
DMARC (Domain-based Message Authentication, Reporting & Conformance)
A policy published at _dmarc.<domain> that tells receivers what to do when SPF and/or DKIM fail: none (monitor), quarantine (spam), or reject.
Alignment (relaxed vs strict)
Whether the authenticated domain must exactly match the From domain (strict, adkim=s/aspf=s) or may share an organizational domain (relaxed, the default).
rua / ruf
DMARC report addresses: rua receives daily aggregate reports (volume, pass/fail by source); ruf receives forensic samples of failing messages.
Selector
The label naming a DKIM key, used both in the DKIM-Signature header of an email and in the DNS record <selector>._domainkey.<domain>.
pct tag
A DMARC tag (0–100) applying the policy to only that percentage of messages — used to roll out quarantine/reject gradually.
Organizational domain
The registrable domain under which subdomains sit (example.co.uk, not mail.example.co.uk). DMARC policies for subdomains fall back to it.

Frequently Asked Questions

How do I pass Gmail’s DMARC requirements for bulk senders?
Since February 2024, Gmail requires bulk senders (5,000+ messages/day to Gmail) to publish SPF and DKIM for their sending domain, and a DMARC record of at least p=none. Run this checker on your domain: aim for SPF pass with a valid all mechanism, at least one working DKIM selector, and a DMARC record with rua reporting. Then move toward p=quarantine or p=reject for full enforcement.
What are Yahoo’s bulk sender requirements?
Yahoo’s 2024 requirements mirror Gmail’s: SPF and DKIM authentication plus a published DMARC policy (p=none minimum). The 5,000-message daily threshold applies per sender domain. Use this tool to verify each requirement before you rely on deliverability.
What is the SPF 10-lookup limit?
RFC 7208 limits SPF evaluation to 10 DNS lookups (include, a, mx, ptr, exists, and redirect mechanisms each cost one). Exceed it and receivers return permerror — SPF silently fails. This checker shows the lookup count as a prominent counter and the SPF builder warns live before you cross the limit. Fix it by flattening includes into ip4/ip6 entries (which cost nothing).
What’s the difference between p=none, p=quarantine, and p=reject?
p=none monitors only — you get reports but no action is taken on failing mail. p=quarantine sends unauthenticated mail to spam (partially controlled by the pct tag). p=reject blocks it entirely. The recommended rollout is p=none with rua reports first, then quarantine, then reject once reports show legitimate mail passing.
What is a DKIM selector and why can’t the checker find mine?
DKIM keys are published at <selector>._domainkey.<domain>, so the selector name is needed to find the record. The tool probes 24+ common selector names automatically. If your provider uses a custom one (e.g., a random string), enter it in the selectors field. DKIM can only be fully verified with the exact selector used in a real email’s DKIM-Signature header.
Why do multiple SPF records break my email?
RFC 7208 allows exactly one SPF record per domain. If two v=spf1 TXT records exist, receivers return a permanent error (permerror) and SPF authentication fails — which can send your mail to spam. Merge the records into one, keeping the combined mechanisms under 10 lookups.
How is the 0–100 score calculated?
DMARC and SPF each contribute up to 35 points and DKIM up to 30, weighted by status (pass, warn, fail), with additional deductions per issue severity. A grade of A (90+) means all three are correctly published; a missing DMARC record alone caps you well below a B.
Does the checker store the domains I query?
No. Queries are processed server-side against Google Public DNS and cached in memory for 2 minutes for performance; your check history lives only in your browser’s localStorage.
Can I check a subdomain’s DMARC policy?
Yes. If the subdomain has no _dmarc record, the tool automatically checks the organizational domain (e.g., example.co.uk for mail.example.co.uk) per RFC 7489 fallback rules and flags that the policy is inherited.

Related Developer Tools