SPF, DKIM & DMARC Checker
Enter your email domain to check its MX, SPF, DKIM and DMARC records and see, in plain English, whether attackers could send email as your business and what to fix.
Checks MX, SPF, DKIM (common selectors) and DMARC over DNS over HTTPS from your browser. Enter the part after the @ in your email address.
What the four checks mean
MX shows where email for the domain is delivered and which provider you use. SPF is a list of servers allowed to send email for the domain. DKIM is a cryptographic signature added to outgoing mail that proves the domain sent it and it was not altered. DMARC ties the two together and tells receiving servers what to do when a message fails, and where to send reports.
All three need to be in place. SPF alone breaks when mail is forwarded. DKIM alone says nothing about what to do with unsigned mail. DMARC without the other two has nothing to enforce.
How to read the verdict
Protected means SPF ends in -all, a DKIM key is published, and DMARC is set to quarantine or reject. Receiving servers will refuse or junk mail that pretends to come from you.
Partly protected usually means one of three things: SPF ends in ~all, no DKIM key was found on the common selector names, or DMARC is at p=none. The most common and most important of these is p=none, which is where most UK businesses sit. It monitors but does nothing. Moving to p=quarantine is a one-word change once the reports show your legitimate mail passing.
Exposed means SPF or DMARC is missing or invalid. Anyone can send email as the domain and most receivers will deliver it. This is the setting that makes invoice fraud and CEO impersonation work.
Fixing it on Microsoft 365
SPF: one TXT record on the domain reading v=spf1 include:spf.protection.outlook.com -all, plus an include for each other service that sends as you, such as your accounts package or marketing platform. DKIM: enable it in the Defender portal under Email authentication settings, then publish the two selector1 and selector2 CNAME records it gives you. DMARC: a TXT record at _dmarc.yourdomain reading v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain; and move to p=reject after a few weeks of clean reports.
SPF, DKIM & DMARC Checker: common questions
My domain shows DMARC p=none. Is that a problem?
Yes, in practice. p=none tells receivers to take no action on mail that fails authentication, so spoofed email is still delivered. It is the right starting point for a few weeks of monitoring, but many businesses set it years ago and never moved on. Change it to p=quarantine, then p=reject, once the reports show your legitimate senders passing.
Why does DKIM show a warning when my provider says it is enabled?
The tool checks the most common selector names, including those used by Microsoft 365 and Google Workspace. Some providers and marketing platforms use a custom selector, which the tool cannot guess. If DKIM is confirmed enabled in your provider and the selector is custom, the warning can be ignored.
What is the 10 DNS lookup limit in SPF?
Receiving servers stop evaluating an SPF record after ten DNS lookups, and treat the result as a permanent error. Every include, a, mx, exists and redirect counts, including the ones nested inside your providersā records. Domains that have accumulated several marketing and helpdesk tools often go over without noticing, at which point SPF silently stops working.
We do not send email from this domain. Do we still need these records?
Yes. Attackers prefer unused and parked domains precisely because nobody watches them. Publish v=spf1 -all as the SPF record and a DMARC record of v=DMARC1; p=reject; so that anything sent as that domain is refused.
Does this tool store the domain I check?
No. The lookups go straight from your browser to a public DNS over HTTPS resolver. Nothing is sent to our servers and nothing is logged.
More free tools
Want these checked every day, not once?
Records drift. A new marketing tool, a change of supplier or a well-meaning edit can break SPF or leave DMARC at p=none for years. Our Microsoft 365 monitoring checks every domain you own continuously and reports what to fix.