Free tool
DMARC, SPF and DKIM checker
A DMARC checker tests whether a domain tells receiving mail servers how to treat email that claims to come from it. Type a domain and this reads its DMARC, SPF and DKIM records, counts the DNS lookups its SPF record needs, and lists what to fix, most serious first.
Updated · reads the domain’s DNS live, from your browser
What it reads
Everything comes from public DNS, read from your browser through Cloudflare’s and Google’s DNS-over-HTTPS resolvers. Nothing passes through our servers.
- MX on the domain: where its email is delivered.
- SPF: the TXT record on the domain starting
v=spf1, plus every record it includes, to count the DNS lookups a receiver must make. - DMARC: the TXT record at
_dmarc.the domain, or at its parent domain if the name you typed has none. - DKIM: public keys at
selector._domainkey.the domain, for 36 selectors used by Google Workspace, Microsoft 365, Zoho, Proton, Fastmail, Mailchimp, SendGrid, Mailgun, HubSpot and others. - MTA-STS, TLS-RPT and BIMI, reported if present.
DMARC policies
| Policy | What receivers do with mail that fails | When to use it |
|---|---|---|
p=none | Deliver it as normal, and send you reports | The first weeks, while you find every service that sends as you |
p=quarantine | Put it in spam | Once the reports show your own mail passing |
p=reject | Refuse it | The goal. Spoofed mail never reaches an inbox |
A policy of none is flagged as something to check, not as an error. It is where every rollout starts, and the rua address it reports to is how you find the newsletter tool or CRM you forgot was sending as you. Gmail and Yahoo have required a DMARC record, even at p=none, from bulk senders since February 2024, and SPF or DKIM from everyone.
SPF and the 10-lookup limit
An SPF record lists the servers allowed to send as the domain, mostly by including other providers’ records. Each include, a, mx, ptr, exists and redirect costs the receiver a DNS lookup, includes nested inside includes count too, and RFC 7208 caps the total at 10. One more and the result is a permerror: SPF fails for every message, including the legitimate ones. Each SaaS tool that asks you to "add our include" moves you closer, so this checker follows every include and shows the count.
Two other SPF mistakes are flagged as errors because they are always wrong: more than one SPF record on the same name, and a record ending in +all, which authorises every server on the internet.
DKIM, and why the selector has to be guessed
DKIM keys are published at a name made from a selector the sender picks, and DNS offers no way to list them. The only place the selector is written down is the s= tag in the DKIM-Signature header of an email the domain sent. So this checker tries the selectors the major providers use and reports any key it finds with its strength. Finding none does not mean DKIM is off; open the headers of a message you sent and look up s=selector._domainkey.yourdomain with the DNS lookup.
Domains that send no email
Every domain can be spoofed, including the ones that never send a message: brand variants, typo domains, old campaign names. For those, the right setup is two records, v=spf1 -all on the domain and v=DMARC1; p=reject at _dmarc, which tell receivers to refuse anything claiming to come from it. The checker recognises that setup and marks it as correct rather than as a domain with problems.
Email ends when the domain does
None of these records survive a lapsed registration. When a domain passes its expiry date and the registrar deletes it or puts it on hold, the domain leaves DNS and its MX records go with it. DropPerch reads the registry for every domain you watch and emails you before that happens, at 30, 14, 7 and 1 days, across every registrar.
Common questions
How do I check my DMARC record?
Type your domain above and press Check email records. The page reads the TXT record at _dmarc.yourdomain from public DNS and shows the policy, the reporting address and anything that weakens it, together with your SPF and DKIM records.
What is a good DMARC policy?
p=reject, with a rua address so you receive aggregate reports. Most domains get there in steps: p=none while the reports show who sends as them, then p=quarantine, then p=reject once their own mail passes.
Why does my SPF record fail with too many DNS lookups?
RFC 7208 allows at most 10 DNS lookups while evaluating SPF, counting every include, a, mx, ptr, exists and redirect, including those inside included records. Past 10 the result is a permerror and SPF fails. Remove includes for services you no longer use, or replace some with ip4 and ip6 ranges.
Why can it not find my DKIM record?
DKIM keys live at a selector the sender chooses, and DNS cannot list them. The checker tries 36 common selectors. Yours is the s= value in the DKIM-Signature header of an email you sent; look up selector._domainkey.yourdomain with the DNS lookup tool.
Do domains that send no email need SPF and DMARC?
Yes. Spammers spoof unused domains precisely because nobody watches them. Publish v=spf1 -all on the domain and v=DMARC1; p=reject at _dmarc, and receivers will refuse mail that claims to come from it.
Is this DMARC checker free?
Yes, with no signup and no limit. It runs in your browser and reads public DNS directly, so nothing is sent to or stored by us.
An expired domain takes its email with it
When a domain lapses, its MX records stop answering and every message bounces, however good its SPF, DKIM and DMARC were. DropPerch reads the registry record for every domain you watch and emails you before it expires, and on paid plans the moment its nameservers or registrar change. Any registrar, no transfer, no card: 25 domains free for the first 25 accounts, 5 after.