WITTCO
Login

Free IT Toolbox

Email security checker.

Check the public SPF, DKIM and DMARC records for your email domain, with plain explanations of what was found and what could not be confirmed. This tool sends the domain and selector names to our server and public DNS resolvers. No email is sent and no account is needed.

Enter a public domain without https:// or a path. We send the domain, SPF targets, parent policy names and DKIM selector names to public DNS resolvers. Results may be cached for one minute.

Enter up to four names, separated by commas. Find yours in your provider’s settings or the s= value in a DKIM-Signature email header. Leave blank to check selector1, selector2, google and default. Other selectors are not checked.

What these records tell you

SPF lists allowed sending servers. DKIM publishes a public key that receivers can use to verify signatures. DMARC tells receivers how to treat messages that fail its authentication and alignment checks.

A DNS record alone does not prove that your mail provider uses it correctly. Send a test message yourself and inspect its authentication results. Never tighten a policy before confirming all real senders.

For a subdomain, the checker searches up to eight DMARC policy names, including parent names, using the discovery rules in RFC 9989. Older receivers may use different discovery rules. It does not evaluate a message’s alignment or test report delivery.

Need website and domain checks too? Run the Free Technology Checkup.

See all free IT tools