Skip to content
>_ITDITDWeb Security Platform

SPF / DKIM / DMARC Checker

Enter a domain to check the three anti-spoofing email mechanisms (SPF, DKIM, DMARC) in DNS, with the gaps and how to fix them.

This tool only queries DNS TXT records (it never connects to the target server). Your data is never sent. Because DKIM selectors aren't public, it probes a list of common selectors.
Please use this on sites you own or manage. Don't use it to probe someone else's site without permission.
Try an example (check this site itself)

itdef.net

SPFOK

Declares which servers may send mail for the domain.

v=spf1 include:spf.brevo.com -all
DKIMOK

Signs outgoing mail so tampering/spoofing can be detected.

Selectors found: brevo1, brevo2
DMARCWeakp=none · rua ✓

Declares how to treat fakes that fail SPF/DKIM (none/quarantine/reject).

v=DMARC1; p=none; rua=mailto:rua@dmarc.brevo.com

`p=none` is monitor-only. When clean, raise to `p=quarantine` then `p=reject` to actually stop spoofing.

AI remediation prompt (copy-paste)

Paste into Claude / ChatGPT to get fixes for your DNS / sending provider.

You are an email-authentication (SPF / DKIM / DMARC) expert. My domain (itdef.net) has gaps in its anti-spoofing setup. For defensive purposes only, give me the exact DNS records and steps to set the following safely. If you don't know my sending provider (Gmail / Google Workspace / Brevo / SendGrid / Amazon SES, etc.), ask. Also tell me how to verify it afterward.

- DMARC（weak）→ `p=none` is monitor-only. When clean, raise to `p=quarantine` then `p=reject` to actually stop spoofing.

Note: I don't want to break legitimate mail by being too strict at once. Please describe a staged rollout (DMARC none → quarantine → reject).

How to use

  1. 1

    Enter your sending domain (an email address works too).

  2. 2

    SPF, DKIM and DMARC DNS records are inspected.

  3. 3

    Harden the “missing” / “weak” items using the shown fixes.

Why it matters

SPF, DKIM and DMARC are the trio that stop spoofed (impersonation / phishing) email from your domain. SPF validates the sending IP, DKIM checks a signature, and DMARC declares what to do with fakes (quarantine/reject). The key is not to leave DMARC at p=none (monitor only) — step it up to quarantine then reject.

FAQ

QDKIM shows 'missing' but I have it set up.
A

DKIM selectors (e.g. google, brevo1) differ per provider and can't be enumerated from DNS. This tool probes common selectors, so a custom one may go undetected. Check `selector._domainkey.domain` with your provider's selector.

QIs DMARC p=none not enough?
A

none means 'monitor only, do nothing'. Start at none with reports (rua), then raise to quarantine (to spam) and reject — that's what actually stops spoofing.

Related