SPF, DKIM & DMARC Checker
Review supported domain email-authentication DNS records to identify configuration gaps, prevent domain spoofing, and ensure deliverability.
How to Use This Tool
Run an automated assessment in three straightforward steps.
Input Domain Name
Type your root domain name (e.g. yourcompany.com). No email credentials or DNS API tokens are required.
Public DNS Query
SiteSecura queries authoritative DNS servers for TXT, MX, and DNSSEC records matching your domain.
Review Authentication Gaps
Check whether SPF and DMARC policies are configured, identify syntax warnings, and view step-by-step DNS record recommendations.
Domain Email DNS Signals
SiteSecura queries publicly published DNS records to evaluate email security and sender authentication.
SPF (Sender Policy Framework) Record
Outbound Sender VerificationQueries domain DNS for TXT records starting with `v=spf1`, evaluating authorized IP/include mechanisms, syntax validity, and lookup limits.
DMARC (Domain-based Message Authentication) Policy
Domain Spoofing DefenseInspects DNS TXT records at `_dmarc.<domain>` to verify policy enforcement (`p=none`, `p=quarantine`, or `p=reject`) and reporting addresses (`rua`).
MX (Mail Exchanger) Records
Email Delivery RoutingVerifies that mail routing records exist, identifying primary inbound email infrastructure (e.g. Google Workspace, Microsoft 365, Proton).
DNSSEC Zone Authentication
DNS Tampering ProtectionChecks for cryptographic DNSKEY records verifying that DNS responses have not been tampered with or forged in transit.
Interpreting Scan Results
Every scan item receives an explicit status indicator to help you prioritize remediation.
Valid SPF record and active DMARC policy (`p=quarantine` or `p=reject`) detected in domain DNS.
DMARC policy is set to `p=none` (monitoring only, not rejecting spoofed emails), or SPF syntax has minor warnings.
No SPF or DMARC record found in DNS, leaving your domain completely unprotected from email impersonation.
DKIM requires provider-specific selectors; informational guidance is provided on how to verify DKIM in your email provider console.
Practical Remediation Guidance
How to resolve common gaps and harden your server configurations.
Securing your domain against unauthorized email spoofing requires a phased rollout across SPF, DKIM, and DMARC:
Step 1: Publish an SPF Record
Add a TXT record on your apex domain (@) explicitly listing your email service:
Step 2: Configure DKIM in Your Mail Host
Generate 2048-bit DKIM keys in your email provider console (e.g. Google Workspace, Microsoft 365, Mailgun) and publish the CNAME or TXT record at your provider's specific selector.
Step 3: Deploy DMARC in Monitoring Mode
Create a TXT record for _dmarc.yourdomain.com set to p=none with your reporting mailbox:
Step 4: Advance to Enforcement (Quarantine/Reject)
Once aggregate XML reports show all legitimate senders passing authentication, upgrade your policy to p=quarantine or p=reject to eliminate spoofed messages.
Assessment Limitations & Technical Scope
SiteSecura performs deterministic, non-intrusive perimeter checks. Understanding what a passive assessment cannot evaluate ensures responsible risk management:
- •DKIM selectors: Passive scans cannot evaluate DKIM without knowing your provider's private selector (e.g. `google._domainkey`). We do not claim DKIM is missing solely because unknown selectors cannot be guessed.
- •Does not send test emails or verify SMTP inbox delivery across receiving providers.
- •Cannot detect mailbox compromise, weak user passwords, or session cookie hijacking.
- •Does not inspect BIMI (Brand Indicators for Message Identification) VMC certificate chains.
- •DNS propagation delays: Recent DNS edits can take up to several hours to become visible across authoritative name servers.
Recommended Technical Guides
Learn defensive concepts and architectural best practices from our engineering team.
Related Security Utilities
Explore dedicated perimeter verification tools in the SiteSecura toolkit.
Website Security Scanner
Assess HTTPS, certificates, security headers, and domain email authentication in one unified security scan.
SSL/TLS Certificate Checker
Inspect certificate expiration dates, CA issuer chain, SAN domain matching, and supported TLS protocol versions.
HTTP Security Headers Checker
Inspect HSTS, Content-Security-Policy (CSP), and browser defensive response headers to protect users from XSS.
DNS Lookup Tool
Inspect supported A, AAAA, CNAME, MX, NS, TXT, SOA, and CAA records with real-time resolution and explanations.
Frequently Asked Questions
Ready for a Complete Website Security Evaluation?
Run an end-to-end passive scan across HTTPS, SSL certificates, defensive HTTP response headers, and DNS email authentication records in under 60 seconds.