Public DNS authentication
Email DNS Checker: SPF, DKIM, DMARC, and MX
Inspect the records involved in sender authorization and routing. Results show each resolver's evidence so a transport error is never presented as a missing record.
How to read the result
SPF authorizes sending infrastructure, DKIM publishes a verification key under a selector, DMARC defines alignment policy, and MX identifies receiving mail servers. A published record is evidence of DNS configuration—not proof of delivery or inbox placement.
Why two resolvers?
DNS caches and propagation can produce temporary disagreement. This checker queries Cloudflare and Google independently. A missing answer is reported only when both resolvers successfully return no matching data; failures and disagreement remain unknown or propagating.
Next step
After DNS agrees, send a controlled message through the real production path and inspect the receiving server's Authentication-Results header. That verifies which envelope identity, selector, and sender path were actually used.
Questions about this tool
Does an SPF record prove my email is deliverable?
No. It publishes authorization policy. It does not verify a recipient, provider acceptance, server delivery, or inbox placement.
Why do I need a DKIM selector?
DKIM records live below a selector chosen by the sending provider. The visible From domain alone is not enough to discover every possible selector.
Can I publish multiple SPF records?
A domain should have one selectable v=spf1 policy. Multiple SPF records can produce a permanent evaluation error; combine authorized senders into one policy instead.