Does MailAuth Lab store domains I check?

No. Queries run in your browser via public DoH resolvers; we have no backend for this tool.

Is a high score a delivery guarantee?

No. Authentication is only one factor; content and reputation also matter.

Email Authentication Check: SPF, DKIM, DMARC, BIMI & MX

Enter a domain. We query public DNS-over-HTTPS in your browser, score MX/SPF/DKIM/DMARC/BIMI, and show copy-paste fixes. Nothing is sent to our servers.

Enter the sending/receiving domain (and optional DKIM selector)
We fetch MX, SPF, DKIM, DMARC and BIMI over DNS-over-HTTPS
Read pass/warn/fail, raw values, and suggested DNS records

Open email auth checker

Check a domain

JavaScript is required for live DNS lookups. Open a static guide below for manual dig steps and common mistakes.

How to check SPF, DKIM, DMARC and BIMI manually — No JS required — commands and common failure modes for email authentication DNS.

Common SPF and DMARC failures explained — Static explanations of the failures our checker flags most often — usable with JS disabled.

Worked baseline: example.com authentication DNS — Open the live tool with ?d=example.com — this page documents what empty or minimal records mean.

Worked examples

How to check SPF, DKIM, DMARC and BIMI manually No JS required — commands and common failure modes for email authentication DNS.
Common SPF and DMARC failures explained Static explanations of the failures our checker flags most often — usable with JS disabled.
Worked baseline: example.com authentication DNS Open the live tool with ?d=example.com — this page documents what empty or minimal records mean.

FAQ

Why can DMARC be pass while mail still lands in spam?

DMARC only authenticates the domain alignment path. Content, lists, IP reputation and user complaints are separate.

How do I find my DKIM selector?

Open a raw message header, find DKIM-Signature, and read the s= tag. That value is the selector.

More answers on the FAQ page. Pro interest for saved presets.