Free tool
Check your domain's email authentication
See what SPF, DKIM, DMARC and BIMI records your domain actually publishes, and what each one means. No signup, no email required.
Reads public DNS only. Nothing is stored, and we do not email you about it.
What this checks, and why each one matters
- SPF
- A public list of which servers may send email using your domain. Without it, nothing distinguishes your mail server from anyone else's. The most common failure is not a missing record but too many DNS lookups, which silently turns SPF off.
- DKIM
- A cryptographic signature on each message. It is the strongest of the three because, unlike SPF, it survives being forwarded. The classic silent failure is a provider signing with its own domain instead of yours, which produces a valid signature that can never align.
- DMARC
- The instruction that ties the other two together and tells receivers what to do when they fail. It is also the only one that reports back to you about who is sending as your domain.
- BIMI
- The record that puts your logo, and with the right certificate the blue checkmark, next to your name in Gmail. It only works once DMARC is at full enforcement, so it is the last step rather than the first.
A clean result is not the same as being safe
Common questions
Is this really free?
Yes, and there is no signup. It reads public DNS records, which anyone can query. We do not store the domains people check and we do not email you about them.
Why does it say DKIM might be missing when I know I have it?
DKIM selectors cannot be listed from DNS. A checker can only guess common ones, so a negative result means DKIM is not on any of the usual selectors, not that it is absent. We say so in the result rather than reporting a false failure.
What should I fix first?
Anything marked missing. In practice that usually means publishing a DMARC record, because without one nothing tells receiving servers what to do with mail that fails authentication, and Google, Yahoo and Microsoft now require one from bulk senders.
My DMARC says p=none. Is that a problem?
It satisfies the bulk sender requirement but it instructs receivers to take no action, so it does not stop impersonation. It is the correct place to start, because enforcing before every legitimate sender is authenticated blocks your own mail. It is the wrong place to stop.
Can I use this to check a domain I do not own?
Yes. These records are public by design, which is exactly why the gaps matter. Anyone can see whether your domain is protected, including people looking for a domain to impersonate.
Want the full explanation? Email authentication in plain English walks through all of it without jargon, and our setup service is there if you would rather not.