Free DMARC, SPF & DKIM Checker

Yes — fully free with no signup, no rate limits, no usage caps. Every check runs in your browser via Cloudflare's public DNS-over-HTTPS API. We never see what domain you queried and we don't log anything. You can check 100 domains a day and we won't know.

Same data source — public DNS — same accuracy. The difference: this tool runs entirely in your browser (no server intermediary), there's no signup wall, no daily query limit, and no upsell prompts between checks. If you've hit MxToolbox's free-tier rate limit, this is a permanent free alternative.

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS TXT record at _dmarc.yourdomain.com that tells receiving mail servers what to do with email that fails SPF or DKIM checks. It also lets you receive aggregate reports about who's sending mail using your domain — including spoofers.

SPF (Sender Policy Framework) lists which IP addresses are allowed to send email for your domain. DKIM cryptographically signs each outgoing email so receivers can verify integrity. DMARC builds on both — it tells receivers what to do when SPF or DKIM fail (reject, quarantine, or just monitor) and sends you reports. You need all three for proper email security; SPF alone can be bypassed.

Enter any domain in the tool above and click Check. The tool queries the public DNS records for SPF (TXT on the root domain), DMARC (TXT on _dmarc.domain.com), and DKIM (TXT on common selectors like default._domainkey.domain.com) and validates them against best practices. Results show in seconds.

DKIM uses a 'selector' — a custom name chosen by your email provider. There's no way to find every selector without trying each one. This tool checks the most common selectors (default, google, selector1, selector2, k1, mail). If yours uses a non-standard selector (like Mailchimp's k1 or SendGrid's smtpapi), DKIM may still be configured even if our tool can't find it.

Start with p=none and a rua tag pointing to your inbox. Monitor for a few weeks to see what mail is being sent under your domain (legitimate or otherwise). Once you've fixed any legitimate sources that fail SPF/DKIM, move to p=quarantine, then p=reject for full enforcement.

DNS records can change without notice when teams add new email providers (Mailchimp, SendGrid, Postmark, etc). At minimum check monthly, ideally weekly. FortWatch monitors DMARC, SPF, and DKIM continuously and alerts you the moment anything changes — try it free.