SPF, DKIM & DMARC checker
Audit the email authentication of any domain in seconds: SPF syntax and policy strength, DMARC enforcement level, DKIM selectors, MX records — with concrete recommendations.
The three DNS records that decide if your email lands
Modern spam filtering is built on three DNS records. SPF declares who may send for your domain, DKIM cryptographically signs each message, and DMARC tells receivers what to do when the first two fail — and where to send the reports. Get them right and your mail reaches inboxes; get them wrong and even legitimate newsletters end up in spam.
This tool resolves all three for any domain, checks them for the most common misconfigurations — multiple SPF records, softfail-only policies, DMARC stuck at p=none — and probes the usual DKIM selectors used by Google Workspace, Microsoft 365 and the main ESPs.
Records that are correct today can break tomorrow when a provider changes its IP ranges. SiteFlux can monitor your DNS records continuously and alert you before deliverability quietly degrades.
Frequently asked questions
What is SPF and what does it do?
SPF (Sender Policy Framework) is a DNS TXT record listing the mail servers authorized to send email for your domain. Receiving servers check it to decide whether to accept, mark or reject messages that claim to come from you. Exactly one SPF record is allowed per domain.
What is the difference between ~all and -all in SPF?
The final mechanism defines the policy for everyone not listed: ~all (softfail) tells receivers to accept but flag suspicious mail, while -all (hardfail) tells them to reject it. Softfail is common while calibrating a setup, but -all offers real protection once all legitimate senders are included.
What does a DMARC policy of p=none mean?
p=none means 'monitor only': receivers send you reports but take no action on failing mail. It's the recommended starting point to collect data, but moving to quarantine (p=quarantine) or reject (p=reject) is what actually stops your domain being used in phishing.
Why can't the tool find my DKIM record?
DKIM records are published under a selector chosen by your email provider (like google, s1 or k1), so the tool probes the most common ones. If you use an unusual selector, enter it in the optional field. DKIM is also optional for deliverability — SPF and DMARC are the priority.
Will fixing these records stop spam being sent from my domain?
It stops it from being delivered to inboxes that check authentication: with DMARC enforcement, spoofed messages fail the checks and get rejected. It cannot stop the spam from being sent, but it makes it ineffective.
Audit your email authentication once — SiteFlux monitors your DNS records 24/7 and alerts you when a change breaks deliverability.
Create a free monitor →