Skip to content
EnterraHost
Client Area Find a domain
Products
Build a bundle Domain Names Shared Web Hosting Business Email Mail Protection EnterraMon EnterraSEO EnterraEdit
Tools
SPF, DKIM and DMARC Checker Ping Test Traceroute Server Check IPv6 Test DNS Lookup MAC Address Lookup Robots.txt Tester Broken Link Checker Link Visualiser Sitemap Validator
Hosting Email Support Client Area Find a domain
Easy utilities

SPF, DKIM and DMARC checker

Read the three records that decide whether your mail is trusted, and what each one actually says. No signup, no sending, DNS only.

Not sure what to put in them? How to add SPF, DKIM and DMARC, step by step.

Checks the apex TXT records for SPF, _dmarc for DMARC, and the usual DKIM selectors. Public domains only.

DKIM not found? Tell the check where to look.

Some providers generate a random selector per domain — Polaris, for example, publishes under a name like hdkfbx._domainkey. Nothing in DNS lists those, so no checker can guess one. Either paste the selector, or paste any DKIM-Signature header from an email that domain sent you and we will read the selector out of it.

Reading the result

What each record actually does.

SPF says who may send

One TXT record at the apex listing the servers allowed to send as this domain. Two records is a permerror and receivers ignore both — the single most common real fault we find.

DKIM signs the message

A public key at <selector>._domainkey lets a receiver verify the message was not altered. The selector is chosen by the sender, so a checker can only try the common ones.

DMARC says what to do when they fail

Without a DMARC record, a failing message is still delivered and nobody tells you. With p=none you get reports; with quarantine or reject you get enforcement.