SPF & DMARC Checker — Verify Sender Authentication
Paste domains and this checker reads each domain's SPF record plus its DMARC policy at _dmarc over DNS-over-HTTPS. Like the MX Lookup, it runs only when you click and sends domain names only. DKIM needs a per-domain selector, so it can't be auto-discovered — the results explain exactly how to check yours manually.
- 100% in your browser
- No signup · no uploads
- Free to use
drop files here
Results
Nothing processed yet. Add content above and press the action button — everything runs locally in this tab.
History
Optionally remember runs on this device, sealed with your passphrase. Off by default; entries expire after 30 days.
Expires after 30 days; forgetting the passphrase erases access permanently.
How it works
- 01
Add your content
Paste text or drop TXT, CSV, XLSX, DOCX and PDF files into the workspace.
- 02
Run the tool
One press runs the pipeline locally in a Web Worker. Change the options and results update automatically.
- 03
Copy or download
Export results as TXT, CSV or JSON. Your content is never uploaded.
What SPF and DMARC actually control
SPF declares which servers may send for a domain; DMARC tells receivers what to do when authentication fails. Together they decide how much of your mail reaches inboxes versus spam — and whether attackers can spoof your domain convincingly. Missing records are among the cheapest deliverability wins available: both are plain DNS records you can publish in minutes.
This checker reads each domain's SPF record and its DMARC policy at _dmarc over DNS-over-HTTPS, only after you click run, sending domain names only.
Reading the results
Pass means the record exists and parses. Missing means the lookup completed and found nothing — a concrete to-do for whoever owns the domain's DNS. Unknown means DNS was unreachable; retry rather than concluding anything.
- SPF pass + DMARC pass → authentication baseline covered
- Missing SPF → spoofing is easy; publish a record
- Missing DMARC → receivers get no failure instruction; publish p=none first, then enforce
Why DKIM isn't auto-checked
DKIM records live under a per-domain selector such as default._domainkey, and selectors can't be discovered reliably — guessing them would burn DNS queries and still miss. To check yours, query TXT at SELECTOR._domainkey.YOURDOMAIN with any DNS lookup tool, replacing SELECTOR with the value your mail provider gave you.
Last reviewed: 2026-09-16 · By the Email Extractor Team · About our privacy-first approach
Keep reading
SPF, DKIM and DMARC setup guide
Publish the three records, in the safe order.
Email list hygiene and validation
List quality vs. domain authentication — both matter.
Reduce bounce rate with a clean list
Authentication is the other half of deliverability.
Role-based addresses in outreach
What authentication can't fix about shared inboxes.
Frequently asked questions
Why isn't DKIM checked automatically?
DKIM records live under a per-domain selector (like default._domainkey) that can't be guessed reliably. The results link the manual lookup pattern so you can check your own selector in seconds.
What does missing SPF or DMARC mean?
Missing SPF means anyone can more easily spoof the domain; missing DMARC means receivers get no instruction for handling failures. Both are fixable DNS records, not verdicts on any single address.
What leaves my browser when I run this?
Domain names only, sent to a DNS-over-HTTPS provider after you click run. Nothing else is transmitted.