Online Tools › Email Authentication Checker

📧 Email Authentication (SPF • DKIM • DMARC)

Checks your domain's public DNS TXT records for email authentication. This does not issue an SSL/TLS certificate; it only verifies mail-related DNS.

GuideHow to check your email authentication

Enter your domain. Use the domain your mail is sent from — the part after the @ in your addresses.
Run the check. The tool looks up your public DNS TXT records for SPF, DKIM and DMARC. No mailbox or password is ever involved.
Read each result. You'll see whether each record exists and how it's configured.
Fix the gaps. Add or correct the missing records in your DNS so mailbox providers can verify your mail.

What SPF, DKIM and DMARC do

SPF (Sender Policy Framework): lists which servers are allowed to send mail for your domain. Receivers reject mail from servers not on the list.
DKIM (DomainKeys Identified Mail): adds a cryptographic signature to each message so the receiver can confirm it wasn't altered and really came from your domain.
DMARC: ties SPF and DKIM together and tells receivers what to do when a message fails — monitor, quarantine, or reject — plus where to send reports.

Why email authentication matters

Without these records, mailbox providers can't tell your real mail from a spoofed message pretending to be you. The result is twofold: your legitimate email lands in spam, and attackers can impersonate your domain in phishing. Since 2024, Gmail and Yahoo require SPF, DKIM and DMARC for bulk senders — so missing records increasingly mean undelivered mail, not just weaker security.

Common problems this reveals

No SPF record. Or multiple SPF records, which is invalid — there must be exactly one.
DKIM not published. Your mail is signed but the public key isn't in DNS, so signatures can't be verified.
DMARC missing or set to p=none forever. You get reports but never enforce, so spoofing still gets through.
Too many DNS lookups in SPF. Exceeding the limit causes SPF to fail even when it looks correct.

Email authentication secures who can send as your domain. To sign and encrypt the content of individual messages, you need an S/MIME certificate — a separate, complementary layer.

Frequently asked questions

Does this read my emails or need my password?

No. It only queries your domain's public DNS TXT records — the same information any mail server can already see. No mailbox access, no credentials.

Is email authentication the same as an SSL certificate?

No. SPF/DKIM/DMARC are DNS records that authenticate your mail. An SSL/TLS certificate secures your website. This tool checks the former and issues nothing.

Do I need SPF, DKIM and DMARC all three?

Yes, for reliable delivery. SPF and DKIM prove authenticity two different ways; DMARC enforces them and gives you reporting. Gmail and Yahoo now expect all three from bulk senders.

What's the difference between this and S/MIME?

These records authenticate your domain's mail servers. S/MIME signs and encrypts individual messages with a certificate. They solve different problems and work well together.

Mail secured — now protect your website and message content.

Compare SSL plans →

Email Authentication Checker (SPF • DKIM • DMARC)