MailAuth LabHow to check SPF, DKIM, DMARC and BIMI manually
No JS required — commands and common failure modes for email authentication DNS.
- Mx Query
- dig MX example.com +short
- Spf Query
- dig TXT example.com +short | grep spf1
- Dmarc Query
- dig TXT _dmarc.example.com +short
- Dkim Query
- dig TXT <selector>._domainkey.example.com +short
- Bimi Query
- dig TXT default._bimi.example.com +short
MailAuth Lab is a free, browser-only email authentication checker for SPF, DKIM, DMARC, BIMI and MX. It finds configuration problems and suggests paste-ready DNS records. It does not promise higher inbox placement or conversion.
Manual path without our UI: query MX for receipt, apex TXT for v=spf1 (exactly one record; note the all qualifier and include count), _dmarc.<domain> for v=DMARC1 (p=, rua=, pct, sp), <selector>._domainkey.<domain> for DKIM p=, and default._bimi.<domain> for BIMI l=/a=.
Common mistakes: publishing two SPF TXT strings; ending SPF with +all; more than ten SPF DNS lookup mechanisms (RFC 7208); DMARC p=none with no rua (no reports to learn from); DKIM selector guessed wrong; BIMI published while DMARC is still p=none or pct below 100.
Prefer Cloudflare or Google DNS-over-HTTPS JSON endpoints when automating. Share live checks with /email-auth-checker/?d=your-domain.example using the tool’s replaceState links.
Free checks are informational only and do not guarantee delivery. Always validate suggested records in a staging DNS view before cutting over production mail.