Email Authentication Checker (SPF, DKIM, DMARC)
Check a domain's SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT records in one pass, with a score and fixes for every problem found.
Frequently Asked Questions
What do SPF, DKIM and DMARC do?
SPF lists the servers allowed to send mail for your domain. DKIM signs each message with a key published in DNS, so receivers can verify it was not altered. DMARC ties the two to the visible From address and tells receivers what to do with mail that fails: nothing (p=none), send it to spam (p=quarantine) or refuse it (p=reject).
Why does SPF fail with "too many DNS lookups"?
SPF allows at most 10 DNS lookups while evaluating a record, counting every include, a, mx, ptr, exists and redirect — including those nested inside included records. Past 10, receivers return a permanent error and SPF fails for all your mail. The checker expands every include and shows the running total so you can see which providers use up the budget.
Why can't the tool find my DKIM record?
DKIM keys live at <selector>._domainkey.<domain>, and there is no way to list a domain's selectors through DNS. The checker tries about 30 selectors common providers use (google, selector1, selector2, k1, s1 and others). If yours is custom, open a message you sent, find the DKIM-Signature header and enter the value of its s= tag.
Is p=none enough for DMARC?
No. p=none only asks receivers to send you reports; spoofed mail is still delivered. It is the right starting point while you read reports and fix legitimate senders, but the goal is p=quarantine and then p=reject. Gmail and Yahoo require at least p=none for bulk senders, and BIMI requires quarantine or reject.
What are MTA-STS and TLS-RPT?
MTA-STS tells sending servers that your mail servers support TLS and that they must not fall back to unencrypted delivery. TLS-RPT gives those servers an address to report TLS failures to. Neither affects whether your outgoing mail is trusted; they protect mail sent to you.
How is the score calculated?
SPF is worth 30 points, DMARC 40 (scaled by how strictly the policy enforces), DKIM 20 and MTA-STS and TLS-RPT 5 each. Warnings cost half a section's points and failures cost all of them. A domain with valid SPF, DKIM and DMARC at p=reject scores 90 or higher.
Is anything sent to ToolDock?
No. DNS queries go straight from your browser to Google Public DNS over HTTPS, and all parsing and scoring happens in the page.