DMARC / SPF / DKIM / BIMI Checker

Pure front-end DNS-over-HTTPS. Optional DKIM selector; leave blank to probe common selectors. Results use history.replaceState for shareable URLs.

Your inputs

JavaScript is required for live DNS lookups. Open a static guide below for manual dig steps and common mistakes.

How to check SPF, DKIM, DMARC and BIMI manually — No JS required — commands and common failure modes for email authentication DNS.

Common SPF and DMARC failures explained — Static explanations of the failures our checker flags most often — usable with JS disabled.

Worked baseline: example.com authentication DNS — Open the live tool with ?d=example.com — this page documents what empty or minimal records mean.

How it works

We ask Cloudflare DNS-over-HTTPS first (Accept: application/dns-json), then fall back to Google DNS JSON API. Responses are normalized to one internal shape before scoring.

MX shows whether the domain can receive mail. SPF is read from apex TXT (v=spf1): multiple records fail; +all fails; include/a/mx/ptr/exists/redirect each count toward the RFC 7208 limit of 10 lookups (estimate on the published record).

DMARC is read from _dmarc.<domain>. We surface p=, sp=, pct, rua, and basic syntax. Missing rua means you will not get aggregate reports — the monitoring hook for Pro.

DKIM probes common selectors unless you supply one; empty p= means the key was revoked. BIMI is read from default._bimi.<domain> and is marked warn unless DMARC is quarantine/reject with pct=100.

Budget: at most 20 DNS queries per analysis, concurrency 4, 4s timeout, 10-minute sessionStorage cache per domain+selector.

FAQ

Why can DMARC be pass while mail still lands in spam?

DMARC only authenticates the domain alignment path. Content, lists, IP reputation and user complaints are separate.

How do I find my DKIM selector?

Open a raw message header, find DKIM-Signature, and read the s= tag. That value is the selector.

DMARC / SPF / DKIM / BIMI Checker

Your inputs

How it works

FAQ

Indexable result pages