Free Email Authentication Checker
Drop in any domain and check its SPF, DKIM, and DMARC records before a spoofed email lands in your customer’s inbox with your name on it. Check My DomainMost email deliverability problems trace back to three DNS records
SPF, DKIM, and DMARC are the records mail servers check before deciding whether an email claiming to be from your domain actually is. Get one of them wrong, or skip it entirely, and legitimate email starts landing in spam — or worse, someone else’s spoofed email lands in your customer’s inbox looking like it came from you.
This free check queries your domain’s live DNS records and scores all three, the same first pass we run on every new client’s domain before we touch a single email campaign.
- DMARC record found but the policy is set to p=none — monitoring only, with no actual enforcement against spoofed email.
Sample result using example data — enter your own details below to get your real score.
Free Email Authentication Checker
Drop in any domain. We will check its SPF, DKIM, and DMARC records — the three signals mail servers use to decide whether your email is legitimate or spoofed — free, no login required.The Three Records We Check
- SPF (Sender Policy Framework)
- A DNS TXT record that lists which mail servers are allowed to send email for your domain. We check that it exists, that there is only one, and that it ends in a restrictive mechanism instead of allowing any server to send as you.
- DKIM (DomainKeys Identified Mail)
- A cryptographic signature attached to outgoing mail that proves it was not altered in transit. We probe the most common selectors used by Google Workspace, Microsoft 365, and other major providers.
- DMARC (Domain-based Message Authentication)
- The policy that tells receiving mail servers what to do when a message fails SPF or DKIM, and where to send reports about who is sending mail using your domain.
Key Terms
SPF (Sender Policy Framework)
A DNS record listing exactly which mail servers are allowed to send email on behalf of a domain. Receiving servers check the sending IP against this list, and a missing or misconfigured SPF record is one of the most common reasons legitimate email lands in spam.
DKIM (DomainKeys Identified Mail)
A cryptographic signature added to outgoing mail that proves the message wasn't altered in transit and really came from the domain it claims to. Google requires at least a 1024-bit key, recommending 2048-bit.
DMARC
A DNS policy record that tells receiving mail servers what to do with messages that fail SPF or DKIM alignment. DMARC was put on the IETF Standards Track in May 2026, formalizing what had been an industry practice for over a decade.
DMARC Policy (none / quarantine / reject)
The enforcement level in a DMARC record. The safe rollout path is p=none (monitor only) for 90+ days, then p=quarantine (spam-folder failing mail), and only then p=reject (block it outright) once you're confident legitimate mail won't be caught.
Bulk Sender Requirements
Google's rule that anyone sending more than 5,000 messages a day to Gmail addresses must have SPF, DKIM, and DMARC all set up, or risk messages being rejected or marked as spam.
Email Authentication Checker FAQ
What are SPF, DKIM, and DMARC, in plain English?
They are three DNS records that work together to prove an email claiming to be from your domain actually came from a server you authorized. SPF lists approved senders, DKIM cryptographically signs the message, and DMARC tells receiving mail servers what to do if either check fails and where to send reports about it.
What exactly does this tool check?
It queries your domain’s public DNS records directly and checks whether a valid SPF record exists with a restrictive policy, whether a DMARC record exists with a meaningful enforcement policy and reporting address, and whether a DKIM record can be found under the most common selectors used by Google Workspace, Microsoft 365, and other major email providers.
Why does this matter for deliverability?
Mailbox providers like Gmail and Outlook increasingly use these three records to decide whether to deliver your email to the inbox, send it to spam, or reject it outright. Missing or misconfigured records are one of the most common reasons legitimate marketing and transactional email stops reaching customers.
Is this really free?
Yes. Enter a domain and your email, and you get your results immediately. No credit card and no sales call required to see your score.
What if my DKIM check comes back negative but I know DKIM is set up?
This tool probes the most common DKIM selector names, but some providers use a custom or randomly generated selector that can’t be guessed from the outside. A negative result here means we could not find it under a common name, not that DKIM is definitely missing — check your email provider’s DKIM setup page to confirm.
What do you do with my domain and email?
Your domain is used only to run this DNS check and is not stored beyond your result. Your email is used to send your results and, occasionally, related marketing content for regulated industries and local businesses. You can unsubscribe at any time.
What if my score comes back low?
A low score just means specific, fixable DNS records need attention. Your results include a plain-English explanation of what was found in each category, and you are welcome to book a free strategy call if you want help getting these records configured correctly.
Resources & References
- Google Workspace Admin Help: Email Sender Guidelines — Google's official requirements for SPF, DKIM, and DMARC, including the bulk sender threshold.
- DMARC.org: Overview — The official explanation of how DMARC works, maintained by the organization that stewards the standard.
- Google Workspace Help: Set Up SPF — Google's official walkthrough for creating and publishing an SPF record.
- Google Workspace Help: Set Up DKIM — Google's official walkthrough for generating and publishing a DKIM key.
Built and reviewed by Chris Goodman, CEO of Tridigiam
Founder of a Las Vegas marketing agency building AI-visibility and compliance-aware marketing systems for regulated industries — healthcare, addiction treatment, and aesthetics. LinkedIn
Related Free Tools
SPF, DKIM, and DMARC are invisible until deliverability breaks — these two live in the same “you don’t know it’s broken until it’s broken” category.
- Pixel & Conversion Tracking Health Checker — another background system nobody checks until the data stops making sense.
- HTTP Security Headers Checker — both tools cover technical trust signals that browsers, mail servers, and crawlers check silently, with no UI to tell you when they fail.
- Sitemap & Robots.txt Health Checker — same category of foundational technical file nobody looks at after launch day.
Built by an agency that manages email deliverability daily
Tridigiam builds and manages marketing for addiction treatment, behavioral health, aesthetics, and medical practices every day, and email authentication is one of the first things we check on any new client’s domain.
If your score flags something real, or you just want a second set of eyes before your next email campaign launches, a strategy call is free and there is no obligation.
More Free Tools
Check Everything Else While You Are Here
This is one of twelve free diagnostic tools we built for local and regulated-industry businesses — AI visibility, schema, ad compliance, GBP, landing page CRO, ad spend waste, healthcare compliance, and more.