Free email-authentication toolkit
Check, validate and generate DMARC, SPF and DKIM records — then analyze your aggregate reports and email headers. Eleven tools, no signup, no backend: everything runs right here in your browser.
Look up and explain any domain's live DMARC record.
Validate your SPF record and check the 10-lookup limit.
Verify a DKIM selector is published and the key is valid.
Build a valid _dmarc TXT record with guided options.
List your sending sources and generate a correct v=spf1 record.
Upload XML aggregate reports for an instant compliance dashboard.
Paste a message header and see why it passed or failed DMARC.
Check a BIMI record and whether the logo will actually display.
Generate a DKIM key pair and the TXT record to publish — in your browser.
See a domain's mail servers — and whether the setup is valid DNS.
Follow a CNAME chain and catch a dangling target before someone else does.
The basics, briefly
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a TXT record at _dmarc.yourdomain.com. It tells receiving servers what to do with mail that fails SPF and DKIM — and where to send reports. Use our DMARC checker to read yours.
The policy tag p controls enforcement. none only monitors, quarantine sends failing mail to spam, and reject blocks it outright. Most domains should progress none → quarantine → reject. Use the DMARC generator to build your record.
SPF (Sender Policy Framework) is a TXT record listing which servers may send mail for your domain. Keep it under 10 DNS lookups, end it with ~all or -all, and only publish one SPF record per domain. Use the SPF checker to validate yours.
DKIM adds a cryptographic signature to your mail, published as a TXT record at selector._domainkey.yourdomain.com. You need the selector your provider uses — enter it in the DKIM lookup to verify the key is published.