Logo von nextlevels
Request a project
Check your domain for free

Check SPF, DKIM and DMARC Result in seconds

The check reads the three records from public DNS, shows them as published and gives you a record to copy for every gap.

You find it in the header of a sent email after “s=”. Without it we try default, google and selector1.

  • Public DNS lookups only
  • No email address needed
  • Free, no sign-up

The main domain counts: www.your-domain.com becomes your-domain.com.

What the check covers

The check only reads what anyone can look up in public DNS. It sends no email and needs no access to your mailbox.

  • SPF

    SPF (Sender Policy Framework) defines which servers may send email for your domain. The check looks for the TXT record starting with v=spf1 and verifies that there is exactly one and how it ends.

  • DKIM

    DKIM (DomainKeys Identified Mail) signs every outgoing email, the public key sits in DNS. The check looks for it under the selectors default, google and selector1 and under the selector you enter.

  • DMARC

    DMARC tells receiving servers what to do with emails that fail SPF and DKIM. The check reads the record under _dmarc of your domain. Only p=quarantine or p=reject sorts out forgeries.

  • Mail provider

    From the MX records the check reads whether your email runs on Google Workspace or Microsoft 365 and, if SPF is missing, suggests the record documented for it.

Limits: the check only reads DNS. Whether your emails actually arrive signed shows only in the header of a sent email. It does not check BIMI, MTA-STS or TLS-RPT.

Sources: RFC 7208 (SPF) · RFC 6376 (DKIM) · RFC 9989 (DMARC) · Google Workspace: set up SPF · Microsoft 365: set up SPF

Records as published

Every record as it stands in DNS – with a rating and the finished record for every gap.

Check domain
Result for example.comexample.com

SPFSPF record present and closed

v=spf1 include:_spf.google.com -all

DKIMNo DKIM key under the selectors we tried

DMARCDMARC in monitoring mode only (p=none)

v=DMARC1; p=none; rua=mailto:dmarc@example.com
TXT record for _dmarc.example.comv=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
Example with a made-up domain.

The full Security Check

SPF, DKIM and DMARC are one of six areas in the Security Check. It also checks HTTPS and the certificate, security headers, cookies, exposed files and info leaks of your website.

Go to the Security Check

SPF, DKIM and DMARC: frequent questions

Your question isn't here? Ask us directly

What is the difference between SPF, DKIM and DMARC?
SPF defines which servers may send for your domain. DKIM signs every outgoing email with a key whose public part sits in DNS. DMARC tells receiving servers what to do with emails that fail both checks and sends you reports about them. Only together do the three stop strangers from sending email in your name.
How do I check my SPF record?
Enter your domain in the check. It looks for the TXT record starting with v=spf1, shows it as published and verifies two things: that there is exactly one SPF record and that it ends in ~all or -all. If the record is missing, you get a suggestion to copy.
Why does the check not find my DKIM record?
DKIM keys sit under a selector that can be chosen freely, and selectors cannot be listed from outside. The check tries default, google and selector1. If your mail provider uses another one, enter it in the “DKIM selector” field. You find it in the header of a sent email after “s=”.
Which DMARC policy is the right one?
p=none only monitors and sends reports. p=quarantine puts emails that fail SPF and DKIM into spam. p=reject refuses them. The usual path is to start with p=none, read the reports and then move to quarantine or reject.
Does the check store my domain?
No. The check stores neither the domain nor the result in a database and needs no email address. To prevent abuse the server counts requests per IP address and domain in memory for a short time.

Get your email records right

Send us your domain. We'll tell you which records are missing and who should set them: your team, your hosting provider or us.

Profile picture of Slawa Ditzel, Executive Partner
Slawa Ditzel
Executive Partner
info@next-levels.de +49 (0) 2161 539 71 60