What we check
5 email authentication layers
SPF
Validates your SPF record: authorized sending servers, syntax errors, and the 10-DNS-lookup limit that silently breaks most SPF records. Shows every mechanism and whether it resolves.
DKIM
Checks DKIM keys across common selectors (default, google, selector1, selector2, k1, and more). Reports which selectors publish valid keys and which are missing — so you know exactly what to add at your mail provider.
DMARC
Parses your DMARC policy in full: the enforcement level (none/quarantine/reject), subdomain policy, percentage, and reporting addresses. Flags p=none as the #1 finding — it means spoofing still works against your domain.
BIMI
Checks for a BIMI record and validates the logo URL and certificate requirements. Tells you whether your brand logo can appear in Gmail, Yahoo, and Apple Mail inboxes.
MTA-STS
Verifies your MTA-STS policy and TLS-RPT reporting record — the mechanism that forces encrypted mail delivery and stops downgrade attacks on your MX servers.
Why it matters
p=none means spoofing still works
Business email compromise costs billions every year, and most of it starts with a spoofed domain. If your DMARC policy is p=none — or you have no DMARC record at all — anyone on the internet can send email that looks exactly like it's from you. Your customers, your partners, your team. The fix is free and takes 10 minutes: publish the right DNS records, verify with this checker, and step your policy up to p=reject.
Live DNS
Queries your real DNS records — not cached guesses. What you see is what receivers see.
Exact records
Shows the full record text for every check, so you can copy-paste fixes into your DNS provider.
Graded A–F
One clear grade for your whole email setup, with each layer scored individually.
How it works
What happens when you run the check
Enter any domain and the checker performs live DNS lookups — the same queries receiving mail servers make when your email arrives. There's no cached data, no estimates. Every record shown is what we pulled from your authoritative nameservers seconds ago.
Step 1 — SPF lookup. We query the TXT record at your root domain and parse every mechanism: include, a, mx, ip4/ip6, and the final qualifier (-all vs ~all). We count DNS lookups recursively — the #1 silent SPF killer is exceeding 10 lookups, which causes permerror and fails open.
Step 2 — DKIM discovery. DKIM keys live at [selector]._domainkey.yourdomain.com, but selectors aren't published in a central list. We probe the selectors your provider actually uses — default, google, selector1, selector2, k1, k2, and more — and report which ones return valid RSA keys.
Step 3 — DMARC policy parse. We read _dmarc.yourdomain.com and decode every tag: p (policy), sp (subdomain policy), pct (percentage), rua/ruf (report destinations), adkim/aspf (alignment modes). A missing DMARC record, or p=none, is flagged as the top finding.
Step 4 — BIMI & MTA-STS. We check for a BIMI record (brand logo in inboxes) and validate the SVG URL and certificate chain requirements. Then we verify MTA-STS: the policy file at mta-sts.yourdomain.com/.well-known/mta-sts.txt and the TLS-RPT reporting record. Together these five layers give you the full picture.
Reading your grade
What the A–F grade actually means
Your grade isn't an average — it's gated by your weakest critical layer. Here's the logic:
- A — DMARC at
p=reject, valid SPF (under lookup limit), DKIM keys published, MTA-STS enforced. Spoofing your exact domain is blocked. - B — DMARC at
p=quarantineorp=rejectwith minor gaps (e.g., missing BIMI, SPF near lookup limit, MTA-STS in testing mode). - C — DMARC at
p=none(monitoring only). You can see spoofing in reports but nothing is blocked. Most domains sit here. - D — No DMARC record, or SPF/DKIM critically broken. Spoofing works silently with no visibility.
- F — No email authentication at all, or records with fatal syntax errors. Your domain is fully impersonable.
The fastest win: most domains jump from D to C in 10 minutes by publishing a p=none DMARC record with reporting. That alone gives you visibility into who's sending as you — including attackers. The climb from C to A (enforcement) takes 2–4 weeks of report review, but every step is verifiable with this checker.
FAQ
Common questions
What does the free DMARC checker test?
SPF, DKIM (across common selectors), DMARC policy, BIMI, and MTA-STS — all from live DNS, with pass/warn/fail for each and the exact records found.
Why does p=reject matter?
p=none means 'do nothing' — attackers can still spoof you. Only p=reject blocks spoofed mail outright. It's the target state for every domain.
How do I move to p=reject safely?
Start at p=none with reporting, collect 2–4 weeks of reports, authorize every legitimate sender, then step up through quarantine to reject. Never jump straight to reject.
What is BIMI?
Brand logo in inboxes (Gmail, Yahoo, Apple Mail). Requires DMARC at quarantine/reject plus a trademarked logo. Optional but boosts trust and open rates.
Is it really free?
Yes — no signup, no card, no limits. Same engine as our paid deep scans.
My check fails — what now?
The report pinpoints the broken record. Fix the DNS, wait for propagation (minutes to hours), re-run the checker to confirm.
How is this different from other DMARC checkers?
Most only read your DMARC record. This validates all five layers (SPF, DKIM, DMARC, BIMI, MTA-STS) from live DNS with individual grades — the same engine as our paid deep scans.
Will DMARC break my existing email?
Not with the safe rollout: p=none first (nothing blocked), review reports 2–4 weeks, authorize every legitimate sender, then step up to quarantine and reject.
Can anyone send email as your domain?
Find out in 10 seconds. Free, no signup.
Run the free DMARC check