Verify SPF, DKIM, and DMARC records for any domain. Check email authentication and spoofing protection.
DNS queries via Cloudflare DNS-over-HTTPS. No server-side processing.
DKIM checks common selectors only. Custom selectors may not be detected.
Email was designed without built-in authentication, making it trivial to forge the "From" address. SPF, DKIM, and DMARC are three DNS-based protocols that work together to verify sender identity and prevent email spoofing.
| Protocol | DNS record | What it verifies |
|---|---|---|
| SPF | TXT on domain | Which IP addresses can send email for the domain |
| DKIM | TXT on selector._domainkey | Cryptographic signature proving the email was not altered |
| DMARC | TXT on _dmarc | Policy for handling emails that fail SPF or DKIM |
SMTP allows any server to claim any sender address in the "MAIL FROM" and "From" headers. Without SPF, DKIM, and DMARC, a receiving server has no way to verify the sender is authorized. Attackers exploit this to send phishing emails that appear to come from trusted domains, such as banks, government agencies, or internal colleagues.
DMARC ties SPF and DKIM together by requiring alignment: the domain in the "From" header must match the domain validated by SPF or DKIM. Without DMARC, an attacker can pass SPF for their own domain while spoofing a different "From" address.
v=spf1 include:_spf.google.com ~all. List all authorized senders and end with -all (hard fail) or ~all (soft fail).selector._domainkey.yourdomain.com.v=DMARC1; p=none; rua=mailto:[email protected] to monitor, then escalate to p=quarantine or p=reject once you confirm legitimate senders pass.Yes. SPF alone does not prevent header spoofing. DKIM alone does not tell receivers what to do with unsigned emails. DMARC ties them together with a policy. All three are required for effective protection and are mandatory for bulk senders to Gmail and Yahoo as of 2024.
The "none" policy tells receiving servers to deliver the email regardless of SPF/DKIM results, but send aggregate reports (rua) to your specified address. Use it as a monitoring phase to identify all legitimate senders before enforcing quarantine or reject.
Enter your domain in the checker above. If SPF is missing, DKIM is not configured, or DMARC is set to p=none (or absent), your domain can be spoofed. For a broader security audit, also check for homoglyph-based phishing of your domain name.