Email Authentication Checker

What This Checks

Enter a domain and the checker queries its DNS for the three records that receiving servers use to decide whether a message claiming to come from you actually did: SPF, DKIM, and DMARC. Each is returned raw, parsed, and with its problems named.

This is on an SEO platform for an unglamorous reason. Outreach email is how most link building actually happens, and client reports are usually delivered by email too. Both fail silently when a domain cannot prove who it is, and the failure looks exactly like being ignored.

Reading the Output

SPF     found
  v=spf1 include:_spf.google.com
         include:sendgrid.net
         include:mailgun.org ~all
  lookups used   9 of 10
  qualifier      ~all  (soft fail)

DKIM    found, 1 selector
  selector       google._domainkey
  key length     2048 bit

DMARC   found
  v=DMARC1; p=none; rua=mailto:...
  policy         none  (monitor only)
  alignment      relaxed

FINDINGS
  SPF near the 10-lookup limit
  DMARC policy takes no action
  no second DKIM selector for rotation

Everything in that example is present and nothing is enforcing anything. A DMARC policy of p=none collects reports and instructs receiving servers to do nothing when a message fails, which is the correct place to start and the wrong place to stay. Domains sit at p=none for years because it never breaks anything, and the record gives roughly the protection of an unplugged alarm.

Nine of ten SPF lookups is the other finding worth acting on. SPF has a hard limit of ten DNS lookups and every include for a sending service consumes at least one. Cross the limit and the whole record fails, which means adding one more tool to your stack breaks authentication for everything.

What Each Record Actually Does

SPF lists which servers may send for your domain. It checks the envelope sender, not the address a human sees, which is why SPF alone does not prevent someone spoofing your visible from address.

DKIM signs each message cryptographically so a receiver can confirm it was not altered and did come from a server holding your key. Two selectors rather than one lets you rotate keys without an outage.

DMARC ties the other two to the address the recipient sees and tells receivers what to do when the check fails. Without it, SPF and DKIM are evidence nobody is required to act on.

Move from none to quarantine to reject gradually, reading the reports at each step. Jumping straight to reject on a domain with forgotten sending services will stop mail you needed.

Questions