Email authentication FAQ

DMARC only covers authentication and alignment. Spam filters also weigh content, engagement, IP/domain reputation, and user complaints. Passing DMARC does not force inbox placement.

RFC 7208 caps the number of DNS-causing mechanisms (include, a, mx, ptr, exists, redirect) at 10 per SPF evaluation. Exceeding it makes SPF fail. We estimate from your published record so you can spot an over-budget policy.

In a received message, open full headers, find DKIM-Signature, and read the s= tag. Check DNS at <s>._domainkey.<your-domain>.

BIMI needs a valid BIMI TXT (l= logo, often a= authority) and DMARC policy quarantine or reject at pct=100, plus client support and often a VMC. Our checker warns when DNS prerequisites are incomplete.

Free: on-demand browser checks, scores, raw records, suggested fixes, shareable ?d= links. Pro (planned): multi-domain schedules, DMARC report inbox daily digests, alerts, history trends, API. Tell us via the subscribe mailto if you want Pro.

No application backend receives your form. The browser talks to public DNS-over-HTTPS resolvers. Hosting may still see standard request logs for the HTML/JS assets.

Yes for practical receivers. Keep a single v=spf1 TXT at the apex. Merge mechanisms instead of publishing two policies.

No. The score summarizes MX/SPF/DKIM/DMARC/BIMI findings only. Delivery also depends on content and reputation. Free checks are informational and not a delivery guarantee.

Cloudflare DNS-over-HTTPS (application/dns-json) first, then Google DNS JSON as fallback. Both are queried from your browser with CORS-friendly public endpoints.