Free DNS, SPF & DMARC Checker

What this checker looks at

Give it a domain and it pulls the records that decide where the site points and whether the domain can be trusted to send email. You get the A and AAAA records (the IPv4 and IPv6 addresses the name resolves to), the MX records that list the mail servers, every TXT record on the domain, and then the three records that matter for email authentication: SPF, DMARC and DKIM. Each of the email records is broken down term by term, so you are not left staring at a line of cryptic syntax trying to work out what it actually allows.

How it works

The lookups run over DNS-over-HTTPS, which is plain DNS wrapped in an ordinary HTTPS request. Your browser asks Google Public DNS at dns.google directly, and if that request fails it retries against Cloudflare at cloudflare-dns.com. Both return JSON, so the page can parse the answer and show it to you in a second or two. There is no backend of ours in the middle. The request goes from your browser straight to the public resolver and the answer comes back the same way.

SPF, DMARC and DKIM, and why they matter

These three records are what stop other people from sending email that pretends to be from your domain. SPF is a TXT record that lists which servers are allowed to send mail for you. A receiving server checks the sender against that list and decides whether the message looks legitimate. DKIM adds a cryptographic signature to each message, and the public half of the key lives in DNS under a selector, so the receiver can confirm the mail really came from you and was not tampered with on the way. DMARC ties the two together. It tells receivers what to do when a message fails both checks, whether to let it through, send it to spam, or reject it outright, and it asks for reports so you can see who is sending as your domain. A domain with all three set up correctly is hard to spoof. A domain missing them is an easy target, and these days mailbox providers increasingly expect to see them.

Problems it flags

The summary at the top calls out the mistakes that quietly break email delivery or leave a domain open to spoofing. It warns when there is no SPF record at all, and it flags an SPF record that ends in +all, which tells the world that any server may send as your domain and defeats the whole point. It catches the case of two separate SPF records, which is a hard error that disables SPF completely. On the DMARC side it points out a missing record, a policy of p=none that only watches instead of blocking, a missing rua address that means no one is collecting the reports, and a pct value below 100. Each flag comes with a short note on what it means and how to fix it.

A note on DKIM selectors

DKIM is the one record you cannot find by asking DNS for it, because the key lives under a selector name that only the domain owner and their mail provider know. If you have an email from the domain, open the raw headers and look at the DKIM-Signature line for the s= value, that is the selector. If you do not, the tool can try the common defaults that big providers use, such as default, google, selector1 and k1, and tell you which ones return a key.

Your lookups stay private

There is no account, no logging, and no database here. The domain you type never touches a server we run. It goes straight from your browser to Google and Cloudflare, the same public resolvers your computer already uses for normal browsing, and the results are rendered on the page and then forgotten when you close the tab. You can open your browser network tab and watch the requests go out to confirm it.

DNS checker FAQ