This free test checks your domain's complete email authentication: SPF including syntax and the 10-lookup limit, DKIM with automatic selector detection and key-length rating, the DMARC policy and its reporting – plus BIMI, MTA-STS and TLS-RPT. Check your domain → Not published yet? Our free Record Studio builds valid SPF, DKIM and DMARC syntax.
Without SPF, DKIM and DMARC, any server can send mail using your sender address – the foundation of phishing and CEO fraud. Together, the three mechanisms make forgeries detectable and give recipients a clear instruction on what to do with such messages. Since 2024, major mailbox providers like Google and Yahoo require SPF or DKIM from every sender; bulk senders (from around 5,000 messages per day at Gmail) need SPF and DKIM plus a DMARC policy. Microsoft applied comparable requirements to Outlook.com, Hotmail and Live on 5 May 2025 and rejects non-compliant bulk mail outright — 550 5.7.515 Access denied, sending domain … does not meet the required authentication level — instead of filing it as junk – so missing authentication costs you deliverability right away.
The SPF record (RFC 7208) lists the servers allowed to send for your domain. The most common real-world mistake: more than 10 DNS lookups caused by nested include: mechanisms – the check then returns permerror and protection fails completely. This test counts the lookups recursively across all include chains. It also rates the final qualifier behaviour (-all instead of the soft ~all, once every legitimate sending path is fully covered).
DKIM (RFC 6376) cryptographically signs every message; the public key lives as a DNS record under <selector>._domainkey.<domain>. This test automatically probes the common selectors used by typical providers and rates the keys it finds: RSA keys should be at least 2048 bits – 1024-bit keys are considered weak and are downgraded accordingly. Ed25519 keys (RFC 8463) are detected too.
DMARC (RFC 9989) ties SPF and DKIM to the visible sender address — a mechanism called alignment — and tells receivers what to do when neither matches: p=none (monitor only), p=quarantine (spam folder) or p=reject (refuse). This test rates the policy and its reporting and shows the alignment settings (aspf/adkim) in detail.
Everything about DMARC in depth → — every tag with its default, the DNS tree walk worked through, ten annotated example records, the rollout plan, and what changed when RFC 9989 replaced RFC 7489.
No. SPF breaks on forwarding, only checks the envelope sender and does not protect the visible From address. Only DKIM signatures plus a DMARC policy connect both checks to the From domain and make spoofing effectively detectable.
The easiest way: open an email you sent yourself and read the s= (selector) and d= (domain) values from the DKIM-Signature header. This test additionally probes the common selectors of typical providers automatically and rates the keys it finds.
p=none is pure monitoring mode: recipients report failures (rua reports) but do not reject forged mail. Right as a starting point, useless as a permanent state – the goal is p=quarantine and finally p=reject.
← All security tests by topic · Run the full domain security check