Email Authentication Checker (SPF, DKIM, DMARC)
Verify your domain's email authentication in real time. Audit SPF 10-lookup limits, DMARC enforcement policies, and DKIM key strength to safeguard inbox placement.
Why Email Authentication Is No Longer Optional
Google Workspace and Yahoo Mail strictly enforce authentication standards for senders. Failure to publish compliant DNS records leads to deferred messages or direct spam-folder routing.
Sender Policy Framework
Specifies which IP addresses and mail servers are authorized to send email on behalf of your domain. Prevents spammers from forging your Return-Path.
DomainKeys Identified Mail
Attaches a cryptographic digital signature to outgoing headers, proving the message was not tampered with or modified in transit by intermediary servers.
Domain-based Reporting & Alignment
Tells receiving servers what to do if SPF or DKIM fails (none, quarantine, reject) and routes aggregate forensic reports to your monitoring address.
Critical DNS Traps We Catch That Basic Checkers Miss
A simple syntax check is not enough. Our audit engine detects silent configuration failures that cause receiving MTAs to reject your emails:
⚠️ The 10 DNS Lookup Limit (RFC 7208)
If your SPF record has more than 10 nested mechanisms (include, a, mx), receiving mail servers immediately abort evaluation with a permanent error (PermError), failing authentication.
🔄 Circular Reference Protection
If an included domain points back to your own domain (e.g. Domain A includes Domain B which includes Domain A), DNS resolvers enter an infinite loop and produce an instant PermError.
📮 External DMARC Destination Verification
If your DMARC report address points to a third-party service (rua=mailto:dmarc@thirdparty.com), RFC mandates that the external domain must explicitly authorize receiving your reports. If unauthorized, reports are silently dropped.
🔑 Deprecated Key Lengths & Revocation
We decode RSA public keys in DER format to verify modular bit length. 1024-bit keys are flagged as weak, and empty p= tags are identified as revoked keys.
Valid DNS Records Are Only Step 1: Understanding Alignment
Publishing valid SPF and DKIM records in DNS does not guarantee delivery if your sending provider fails DMARC Alignment.
DMARC requires that the domain visible to the human recipient in the From: header must align with (match) either the SPF Return-Path domain or the DKIM signing domain (d=).
Furthermore, sending to dead or bouncing email addresses degrades your domain reputation regardless of authentication. Use our verification engine to clean non-existent contacts before dispatching campaigns.
Email Authentication: Frequently Asked Questions
Answers to common questions regarding SPF, DKIM, and DMARC enforcement.
Why does my domain need DMARC if I already have SPF and DKIM?
SPF only verifies the technical envelope sender (Return-Path), and DKIM only verifies that message content was unchanged. Neither ties the visible From address to the authenticated domain. DMARC bridges this gap by requiring alignment and instructing mailbox providers on how to handle unauthenticated spoofing attempts.
How do I find my DKIM selector?
Your DKIM selector is assigned by your email service provider (e.g. Google Workspace, Microsoft 365, Mailchimp, SendGrid). You can find it inside your provider's admin console under email authentication settings, or by inspecting the s= tag in the DKIM-Signature header of a sent test email.
Can I have multiple SPF records for a single domain?
No. RFC 7208 strictly forbids publishing more than one SPF TXT record for a domain. If you publish two records, recipient mail servers will abort with a PermError. You must merge all authorized services into a single unified v=spf1 record.
What does the Google & Yahoo baseline check mean?
Google and Yahoo require bulk senders to have valid SPF, DKIM and a published DMARC record (even if p=none), compliant reverse DNS (PTR), and a spam rate below 0.3%. Our tool audits the DNS portion of these requirements.
Authenticate Your Domain. Clean Your Lists.
Combine enterprise-grade DNS authentication with verified clean prospect databases. Sign up today and get 100 free verification credits.
Verify 100 Emails Free →