Sender Policy Framework is a DNS TXT record listing IP addresses and hosts authorized to send email for a domain, enabling receivers to verify sender IP against published policy.

DomainKeys Identified Mail adds a cryptographic signature to email headers, verified by receivers against a public key published in DNS at selector._domainkey.domain.

Domain-based Message Authentication, Reporting, and Conformance tells receivers how to handle mail failing SPF or DKIM checks and where to send authentication reports.

Do I need SPF, DKIM, and DMARC?

All three work together. SPF and DKIM provide authentication signals; DMARC defines policy and reporting when those signals fail or misalign.

What is the SPF ten lookup limit?

RFC 7208 limits SPF evaluation to ten DNS lookups. Exceeding this causes permerror and SPF failure for all messages from the domain.

What is DMARC alignment?

Alignment requires the From header domain to match the SPF or DKIM authenticated domain. Strict alignment requires exact matches; relaxed allows organizational domain matches.

What DKIM selector should I use?

Selectors are arbitrary labels chosen by your email provider. Google uses google, Microsoft uses selector1 and selector2, and many ESPs use default or k1.

What does SPF -all mean?

The -all mechanism hardfails any sending IP not matched by prior mechanisms, instructing receivers to reject unauthorized senders.

What does SPF ~all mean?

Softfail marks non-matching senders as suspicious but does not instruct definitive rejection. Prefer -all when all legitimate senders are listed.

Can I have multiple SPF records?

No. Multiple SPF TXT records at the same domain invalidate SPF entirely. Merge all includes into a single v=spf1 record.

How long do DNS changes take to propagate?

Propagation depends on TTL values, typically minutes to 48 hours. Rescan after TTL expiry to confirm record updates are visible globally.

What are DMARC aggregate reports?

RUA reports are daily XML summaries sent to addresses in the rua tag, showing authentication pass and fail statistics by source IP and identifier.

When should I use p=reject?

Upgrade to p=reject after weeks of p=none monitoring confirm all legitimate mail sources pass SPF and DKIM with proper alignment.

Does DMARC protect subdomains?

The sp= tag sets subdomain policy. Without sp=, subdomains inherit the p= policy. Publish DMARC at the organizational domain level.

How does BIMI relate to DMARC?

Brand Indicators for Message Identification requires DMARC p=quarantine or p=reject enforcement before displaying verified brand logos in supporting email clients.

Why is my mail failing SPF after adding a new tool?

New SaaS services sending on your behalf need SPF include entries and often separate DKIM selectors. Add both before the service sends production mail.

What key size should DKIM use?

Use 2048-bit RSA keys minimum. Ed25519 keys offer strong security with shorter DNS records and are supported by major providers.

Is this SPF DKIM checker free?

Yes. ScanSuite provides unlimited free email authentication DNS scans without registration or daily limits.

Free SPF DKIM Checker — Email DNS Records

An SPF DKIM checker queries DNS TXT records for a domain's SPF, DKIM, and DMARC policies, validates syntax against RFC 7208 and RFC 7489 specifications, counts SPF DNS lookup depth to detect the 10-lookup limit, verifies DKIM selector public keys, and evaluates DMARC alignment and enforcement policy for email spoofing protection.

Enter a domain name into ScanSuite's SPF DKIM checker and run the scan. The tool retrieves SPF TXT records, probes common DKIM selectors, fetches DMARC _dmarc TXT policies, validates syntax, counts DNS lookups, checks alignment modes, and reports pass, warn, or fail status with remediation steps for each authentication layer.

Email spoofing and phishing remain primary attack vectors because SMTP was designed without sender authentication. SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) form a layered DNS-based defense that tells receiving mail servers which hosts may send on your domain's behalf and how to handle messages that fail verification.

ScanSuite's free SPF DKIM checker queries live DNS records for any domain, validating SPF include chains and lookup counts, discovering DKIM public key selectors, and parsing DMARC policies from _dmarc TXT entries. Results highlight misconfigurations that cause legitimate mail to bounce, enable spoofing, or leave domains without aggregate reporting visibility into authentication failures.

ScanSuite's free SPF DKIM checker validates email authentication DNS records including SPF authorized senders, DKIM public key selectors, and DMARC enforcement policies. Detect lookup limit violations, alignment gaps, and weak p=none configurations before spoofing attacks damage your domain reputation.

Frequently Asked Questions

What is SPF?: Sender Policy Framework is a DNS TXT record listing IP addresses and hosts authorized to send email for a domain, enabling receivers to verify sender IP against published policy.
What is DKIM?: DomainKeys Identified Mail adds a cryptographic signature to email headers, verified by receivers against a public key published in DNS at selector._domainkey.domain.
What is DMARC?: Domain-based Message Authentication, Reporting, and Conformance tells receivers how to handle mail failing SPF or DKIM checks and where to send authentication reports.
Do I need SPF, DKIM, and DMARC?: All three work together. SPF and DKIM provide authentication signals; DMARC defines policy and reporting when those signals fail or misalign.
What is the SPF ten lookup limit?: RFC 7208 limits SPF evaluation to ten DNS lookups. Exceeding this causes permerror and SPF failure for all messages from the domain.
What is DMARC alignment?: Alignment requires the From header domain to match the SPF or DKIM authenticated domain. Strict alignment requires exact matches; relaxed allows organizational domain matches.