This free test checks your domain's complete email authentication: SPF including syntax and the 10-lookup limit, DKIM with automatic selector detection and key-length rating, the DMARC policy and its reporting – plus BIMI, MTA-STS and TLS-RPT. Check your domain → Not published yet? Our free Record Studio builds valid SPF, DKIM and DMARC syntax.
Without SPF, DKIM and DMARC, any server can send mail using your sender address – the foundation of phishing and CEO fraud. Together, the three mechanisms make forgeries detectable and give recipients a clear instruction on what to do with such messages. Since 2024, major mailbox providers like Google and Yahoo require SPF or DKIM from every sender; bulk senders (from around 5,000 messages per day at Gmail) need SPF and DKIM plus a DMARC policy – so missing authentication costs you deliverability right away.
The SPF record (RFC 7208) lists the servers allowed to send for your domain. The most common real-world mistake: more than 10 DNS lookups caused by nested include: mechanisms – the check then returns permerror and protection fails completely. This test counts the lookups recursively across all include chains. It also rates the final qualifier behaviour (-all instead of the soft ~all, once every legitimate sending path is fully covered).
DKIM (RFC 6376) cryptographically signs every message; the public key lives as a DNS record under <selector>._domainkey.<domain>. This test automatically probes the common selectors used by typical providers and rates the keys it finds: RSA keys should be at least 2048 bits – 1024-bit keys are considered weak and are downgraded accordingly. Ed25519 keys (RFC 8463) are detected too.
DMARC (RFC 9989, formerly RFC 7489) ties SPF and DKIM to the visible sender address (alignment) and defines what recipients do with forgeries: p=none (monitor only), p=quarantine (spam folder) or p=reject (reject). The proven staged plan: start with p=none plus rua= reports, analyse the reports, equip every legitimate sending path with SPF/DKIM, then gradually raise the policy to p=reject. This test rates policy and reporting and shows the alignment settings (aspf/adkim) in detail.
No. SPF breaks on forwarding, only checks the envelope sender and does not protect the visible From address. Only DKIM signatures plus a DMARC policy connect both checks to the From domain and make spoofing effectively detectable.
The easiest way: open an email you sent yourself and read the s= (selector) and d= (domain) values from the DKIM-Signature header. This test additionally probes the common selectors of typical providers automatically and rates the keys it finds.
p=none is pure monitoring mode: recipients report failures (rua reports) but do not reject forged mail. Right as a starting point, useless as a permanent state – the goal is p=quarantine and finally p=reject.