SPF, DMARC & DKIM DNS Checker
Inspect public email DNS records, understand configuration issues and prepare reviewable TXT drafts. No account or DNS changes.
Check a domain
Draft TXT records
Uses the domain above. Drafts are not automatic fixes. Review existing records and your provider's instructions first.
From a DNS result to a safer email setup
- Check the domain your mail provider uses for SPF and the visible From domain used for DMARC.
- Inspect the existing TXT records. Do not add a second SPF record or a second DMARC policy at the same name.
- Use a DKIM selector supplied by your provider or the s= value in a DKIM-Signature header. There is no dependable one-click selector discovery.
- Start a new DMARC rollout with a monitoring policy and a reporting destination you control. Review real authentication/alignment results before enforcing quarantine or reject.
- In Cloudflare DNS Records, review Type, Name, Content and TTL separately. Copy the draft's Content value, not the whole report. Keep a backup of current records.
What the score does—and does not—mean
The score is the percentage of this tool's completed, limited DNS configuration checks that pass. It is not a full protocol validator or a promise of inbox delivery. DNS timeouts are reported as unavailable. A missing exact-name DMARC record may inherit a policy; this tool does not perform organizational-domain discovery or a DNS tree walk. SPF include expansion, sender-IP evaluation, DKIM signature verification, reputation, blocklists, reverse DNS and unsubscribe headers are outside this report.
The current DMARC specification, RFC 9989, replaces RFC 7489 and removes its older pct tag. New monitoring drafts here use explicit p=none and do not add pct. For sender obligations, consult Google's sender guidelines and Microsoft's sender policies.
Can this tool change my DNS or fix spam placement automatically?
No. It reads public DNS and creates local drafts. DNS authentication is one part of mail delivery; actual messages also need the appropriate authentication and domain alignment.
Where do the lookups go?
The queried name and TXT type go to Cloudflare DNS-over-HTTPS. The draft reporting email stays in this page until you copy it. This is not a DNS propagation survey across multiple resolvers.
More: General DNS lookup · Cloudflare record-management guide.