Check whether a domain is set up to authenticate its mail. Live DNS lookup; clean breakdown.
Domain only (no protocol, no path). Lookups go to Cloudflare DNS-over-HTTPS from your browser. We do not see them.
All calculations happen in your browser. We don’t store inputs.
A domain like example.com.
Live DNS-over-HTTPS lookup against Cloudflare. We pull the SPF TXT, the DMARC TXT at _dmarc.<domain>, and try the most common DKIM selectors.
A pass/fail breakdown for each record, plus warnings on weak SPF qualifiers and DMARC monitoring-only policies.
You can run this on your own domain to check your setup, or on a domain you suspect is being spoofed.
The query runs from your browser to Cloudflare. We do not see the domain. We do not log it.
A second opinion that does not require an admin account on the target domain.
DKIM uses selectors. We try default, google, selector1, selector2, k1, mail.
If your domain uses a different selector (some ESPs name them like "k2" or "mxvault"), you will see "absent" for the standard ones. Your DNS provider lists every selector under _domainkey.
A starting point, not a complete picture. The blog field note linked below covers the full DKIM-selector enumeration.
This is a domain configuration check, not a delivery check. A domain can have perfect SPF, DKIM, and DMARC and still see messages land in spam (sender reputation, content scoring, recipient rules). Conversely, a domain with all three records missing can still deliver to inboxes that do not enforce auth strictly. The checker tries six common DKIM selectors; if your provider uses something custom, you will see absent for the defaults. Cloudflare's public DoH endpoint receives each query you make; their privacy policy states queries are not logged with personally identifying information, but if that bothers you, do not use this tool.
Once a domain has DMARC set up, the header tells you whether a specific message passed.
Generate the variants attackers use to bypass DMARC by using a different domain entirely.
A plain-English explainer of the three records and how they work together.
Why DMARC pass on the From domain still leaves room for plenty of phishing patterns.
Where authentication fits in the stack and what it does not cover.
Rythm is the inbox protection that powers this estimate. $1.65 per month. Cancel anytime.
Annual on Lightning includes one bonus month. See full pricing.
