DMARC Checker
Check DMARC, SPF, and an optional DKIM selector over DNS
Queries public DNS records over DNS-over-HTTPS. It does not send mail or verify a specific message. Network and DNS failures are shown explicitly.
DNS authentication results will appear here.
About this tool
DMARC Checker gives a fast public-DNS view of email authentication for a domain. It queries the _dmarc TXT record, the domain’s SPF TXT record, and an optional DKIM selector such as google or default through DNS-over-HTTPS. The report highlights enforcement policy, missing records, soft versus hard SPF endings, and practical follow-up checks for alignment and third-party senders. It does not send email, inspect aggregate reports, prove that a specific message passed authentication, or discover an unknown DKIM selector automatically. DNS responses can be cached, delegated, or temporarily unavailable, so use the result as a troubleshooting aid rather than a compliance certificate.
Scenario Recipes
Review a domain before increasing DMARC enforcement
Goal: Check visible DNS policy signals before moving from monitoring toward quarantine or reject.
- Query the domain and enter a DKIM selector confirmed from a real message header or provider guide.
- Review the DMARC policy, SPF ending, reporting address, and reminders for third-party senders.
- Compare with mail reports and recheck after DNS TTL propagation before changing enforcement.
Result: The policy change is based on current DNS evidence and mail-flow review rather than a single lookup alone.
Frequently Asked Questions
What does the checker query?
It queries the domain’s _dmarc TXT record, the domain TXT records for SPF, and the optional selector._domainkey TXT record for DKIM.
Does it send a test email?
No. It only reads public DNS through a DNS-over-HTTPS endpoint.
Can it find the correct DKIM selector automatically?
No. The selector is normally confirmed from the s= value in a real DKIM-Signature header or your email provider’s documentation.
Is p=none a failure?
Not necessarily. p=none is a monitoring policy, but it does not ask receivers to quarantine or reject failing mail. Move to enforcement only after reviewing reports and alignment.
Why can SPF show multiple records?
Multiple SPF TXT records are invalid for a domain. Consolidate them into one SPF policy and stay within the DNS lookup limit.
Can DNS results be stale?
Yes. Resolver and authoritative TTLs can delay changes. Recheck after propagation and compare with an authoritative DNS tool when needed.
Keep browsing