Enter a domain, with an optional DKIM selector, to run SPF, DKIM and DMARC checks together in one report.
Detailed reports: SPF record checker · DKIM lookup · DMARC checker
This page runs the three email authentication checks together for one domain: SPF on the domain itself, DMARC at _dmarc.domain, and DKIM when a selector is supplied (DKIM cannot be checked without one, because selectors cannot be listed from DNS). Each protocol gets a status, pass, warn, fail or missing, based only on what its DNS record actually says, followed by one overall summary sentence. For the full breakdown of any single protocol, including mechanism-by-mechanism parsing, use the dedicated checker linked under each result.
Why is DKIM optional here? DKIM keys live under named selectors and DNS offers no way to enumerate them, so a DKIM check is only possible when a selector is known. Leave the selector blank and this report covers SPF and DMARC, with DKIM marked as not checked.
What makes a protocol show warn instead of pass? A record that exists and works but is weaker than recommended: for example SPF ending in ~all or ?all, DMARC set to quarantine or to reject for only a percentage of mail, or a DKIM key that is shorter than current practice.
Does a pass here guarantee mail will be delivered? No. These checks only confirm what the domain publishes in DNS. Delivery also depends on the sending server's behaviour, message content, reputation and the receiving system's own policies.