Free Security & tech tool
DNS & Email Checker
See every DNS record for a domain, and check that SPF, DKIM and DMARC stop people from faking your email.
- Free
- No sign-up
- Results in seconds
Full audit
This is one part of the full report
Speed, Core Web Vitals, UX, SEO and security in one free report, graded A+ to F, with AI fixes for your platform.
What it checks
DNS records
A, AAAA, CNAME, NS, MX, TXT, CAA and SOA, with how long each one is cached.
SPF
One record, a strict ~all or -all ending, and no more than 10 DNS lookups.
DMARC
Whether spoofed mail is rejected, sent to spam or only monitored, and where reports go.
DKIM
Signing keys at the selector names Google, Microsoft and other big senders use, with key size.
Name servers and DNSSEC
At least two name servers, and whether your records are signed against forgery.
CAA, MTA-STS and BIMI
Which authorities may issue certificates, encrypted mail delivery, and your inbox logo.
Questions
Why does SPF have a limit of 10 lookups?
The SPF standard caps the DNS lookups a check may make at 10, counting include, a, mx, ptr, exists and redirect. Go over it and SPF returns an error, which many inboxes treat as a fail. Remove includes you no longer use.
Why can’t you find my DKIM key?
DKIM keys sit under a selector name that each sender picks, and DNS has no way to list them. We try the common ones, like google and selector1. If yours uses another name, your mail can still be signed.
Which DMARC policy should I use?
Start with p=none and a rua address so you get reports. Once only your own services show up, move to p=quarantine, then p=reject. Gmail and Yahoo have required DMARC for bulk senders since 2024.
Why don’t I see a change I just made?
We ask Cloudflare’s public resolver, 1.1.1.1, which keeps answers for as long as their TTL. A change can take up to the old TTL to show here, and to reach your visitors.