Free SPF DKIM Checker
An SPF DKIM checker queries DNS TXT records for a domain's SPF, DKIM, and DMARC policies, validates syntax against RFC 7208 and RFC 7489 specifications, counts SPF DNS lookup depth to detect the 10-lookup limit, verifies DKIM selector public keys, and evaluates DMARC alignment and enforcement policy for email spoofing protection.
Enter a domain name into ScanSuite's SPF DKIM checker and run the scan. The tool retrieves SPF TXT records, probes common DKIM selectors, fetches DMARC _dmarc TXT policies, validates syntax, counts DNS lookups, checks alignment modes, and reports pass, warn, or fail status with remediation steps for each authentication layer.
Introduction to Email Authentication DNS Validation
Email spoofing and phishing remain primary attack vectors because SMTP was designed without sender authentication. SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) form a layered DNS-based defense that tells receiving mail servers which hosts may send on your domain's behalf and how to handle messages that fail verification.
ScanSuite's free SPF DKIM checker queries live DNS records for any domain, validating SPF include chains and lookup counts, discovering DKIM public key selectors, and parsing DMARC policies from _dmarc TXT entries. Results highlight misconfigurations that cause legitimate mail to bounce, enable spoofing, or leave domains without aggregate reporting visibility into authentication failures.
Combine email DNS scans with DNS lookup for full record inspection, email header analyzer for received message authentication results, and SSL checker to validate TLS on mail submission endpoints discovered during infrastructure review.
What Is an SPF DKIM Checker?
An SPF DKIM checker (also called an email authentication validator) performs DNS lookups against a domain's published authentication records. SPF records live in TXT entries at the domain apex, listing authorized sending IP addresses and include mechanisms referencing third-party senders like Google Workspace, Microsoft 365, SendGrid, and Mailchimp.
DKIM records publish public RSA or Ed25519 keys at selector._domainkey.example.com TXT entries. ScanSuite probes common selectors (default, google, selector1, selector2, k1) and validates key format, algorithm, and bit strength. DMARC records at _dmarc.example.com specify how receivers should treat messages failing SPF or DKIM alignment and where to send aggregate (rua) and forensic (ruf) reports.
The checker validates RFC-compliant syntax, detects SPF permerrors from exceeding ten DNS lookups, flags softfail and neutral policies unsuitable for strict authentication, and evaluates whether DMARC p=reject or p=quarantine policies provide meaningful spoofing protection.
Why Validate SPF, DKIM, and DMARC Records?
Misconfigured email authentication silently degrades deliverability. Overly strict SPF records with missing include entries cause legitimate marketing and transactional mail to fail checks, while missing or p=none DMARC policies leave domains open to exact-domain phishing that bypasses spam filters trained on authentication signals.
Google and Yahoo mandated DMARC enforcement for bulk senders in 2024, requiring aligned SPF or DKIM with progressively stricter policies. ScanSuite helps administrators audit compliance before mailbox providers throttle or reject unauthenticated mail from their domains.
Regular DNS authentication scans complement email header analysis on received messages, port scanning for exposed SMTP services, and DNS lookups when migrating between email service providers.
Who Uses Email Authentication Checkers?
Email administrators and IT teams configure SPF includes and DKIM selectors when onboarding Google Workspace, Microsoft 365, or transactional email providers, verifying records propagate correctly before switching MX routing.
Security teams assess phishing resilience during domain acquisitions and brand protection reviews, ensuring DMARC p=reject blocks unauthorized senders impersonating corporate domains.
Marketing operations validate that ESP (email service provider) DKIM selectors and SPF includes remain intact after DNS provider migrations or subdomain campaign launches.
How the SPF DKIM Checker Works
When you submit a domain, ScanSuite queries DNS TXT records at the apex for SPF (v=spf1), recursively resolves include and redirect mechanisms counting total DNS lookups against the RFC 7208 limit of ten, and flags syntax errors, deprecated ptr mechanisms, and overly permissive +all terminators.
For DKIM, the scanner probes TXT records at common selector subdomains, parses v=DKIM1 records, validates p= public key base64 encoding, k= key type, and t= flags, and reports key sizes below recommended 2048-bit RSA thresholds.
DMARC lookup queries _dmarc.domain TXT records, parsing v=DMARC1 tags: p= policy (none, quarantine, reject), sp= subdomain policy, pct= percentage, adkim= and aspf= alignment modes (strict or relaxed), and rua/ruf reporting URIs. Each layer receives pass, warning, or fail status with specific remediation guidance.
Strong Email Authentication Example
SPF: v=spf1 include:_spf.google.com include:sendgrid.net -all authorizes Google Workspace and SendGrid while hardfailing all other senders.
DKIM: default._domainkey.example.com publishes a valid 2048-bit RSA public key with active message signing.
DMARC: v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=s enforces strict alignment with aggregate reporting.
DMARC Policy Enforcement Comparison
| Policy | Receiver Action | Spoofing Protection | |
|---|---|---|---|
| p=none | Monitor only | No spoofing protection; reporting only | |
| p=quarantine | Spam folder delivery | Moderate; failed mail reaches spam/junk | |
| p=reject | Reject delivery | Strong; unauthorized mail blocked entirely |
Why Does My SPF Record Show Too Many DNS Lookups?
Each include, a, mx, ptr, and redirect mechanism consumes one DNS lookup. Consolidate vendor includes, remove unused mechanisms, and consider SPF flattening for large IP ranges.
Nested includes in third-party SPF records count toward your limit. Audit each include chain with DNS lookup to identify heavy contributors.
Related tools
- Email Header Analyzer — Analyze email headers
- Email Header Analyzer — Verify SPF and DKIM pass on received messages via Authentication-Results headers.
- DNS Lookup — Inspect raw TXT, MX, and NS records for email authentication troubleshooting.
- SSL Checker — Validate TLS on mail submission and webmail HTTPS endpoints.
- Security Headers Checker — Audit web security headers on domains sharing email infrastructure.
- Port Scanner — Discover exposed SMTP, SMTPS, and submission ports on mail servers.
- CORS Checker — Test API endpoints related to email webhook integrations.
Frequently Asked Questions
How do I check SPF and DKIM for my domain?
Enter your domain, plus the DKIM selector if you know it. The tool looks up your SPF TXT record, the DKIM key at `selector._domainkey`, and your DMARC record at `_dmarc`, and flags syntax problems via DNS-over-HTTPS.
How do I find my DKIM selector?
Open the full header of an email you sent and find `s=` in the DKIM-Signature line. Common selectors are `google`, `selector1` and `selector2` (Microsoft 365), and `k1`.
What does "SPF too many DNS lookups" mean?
SPF allows a maximum of 10 DNS lookups (`include`, `a`, `mx` and so on). Going over it causes a permerror. Flatten or trim your includes.
Do I need DMARC as well as SPF and DKIM?
Yes. DMARC tells receivers what to do when checks fail and sends you reports. Start with `p=none`, review the reports, then move to `quarantine` or `reject`.
What is SPF?
Sender Policy Framework is a DNS TXT record listing IP addresses and hosts authorized to send email for a domain, enabling receivers to verify sender IP against published policy.
What is DKIM?
DomainKeys Identified Mail adds a cryptographic signature to email headers, verified by receivers against a public key published in DNS at selector._domainkey.domain.
What is DMARC?
Domain-based Message Authentication, Reporting, and Conformance tells receivers how to handle mail failing SPF or DKIM checks and where to send authentication reports.
Do I need SPF, DKIM, and DMARC?
All three work together. SPF and DKIM provide authentication signals; DMARC defines policy and reporting when those signals fail or misalign.
What is the SPF ten lookup limit?
RFC 7208 limits SPF evaluation to ten DNS lookups. Exceeding this causes permerror and SPF failure for all messages from the domain.
What is DMARC alignment?
Alignment requires the From header domain to match the SPF or DKIM authenticated domain. Strict alignment requires exact matches; relaxed allows organizational domain matches.
What DKIM selector should I use?
Selectors are arbitrary labels chosen by your email provider. Google uses google, Microsoft uses selector1 and selector2, and many ESPs use default or k1.
What does SPF -all mean?
The -all mechanism hardfails any sending IP not matched by prior mechanisms, instructing receivers to reject unauthorized senders.
Can I have multiple SPF records?
No. Multiple SPF TXT records at the same domain invalidate SPF entirely. Merge all includes into a single v=spf1 record.
How long do DNS changes take to propagate?
Propagation depends on TTL values, typically minutes to 48 hours. Rescan after TTL expiry to confirm record updates are visible globally.
What are DMARC aggregate reports?
RUA reports are daily XML summaries sent to addresses in the rua tag, showing authentication pass and fail statistics by source IP and identifier.
When should I use p=reject?
Upgrade to p=reject after weeks of p=none monitoring confirm all legitimate mail sources pass SPF and DKIM with proper alignment.
Does DMARC protect subdomains?
The sp= tag sets subdomain policy. Without sp=, subdomains inherit the p= policy. Publish DMARC at the organizational domain level.
How does BIMI relate to DMARC?
Brand Indicators for Message Identification requires DMARC p=quarantine or p=reject enforcement before displaying verified brand logos in supporting email clients.
Why is my mail failing SPF after adding a new tool?
New SaaS services sending on your behalf need SPF include entries and often separate DKIM selectors. Add both before the service sends production mail.
What key size should DKIM use?
Use 2048-bit RSA keys minimum. Ed25519 keys offer strong security with shorter DNS records and are supported by major providers.
Is this SPF DKIM checker free?
Yes. ScanSuite provides unlimited free email authentication DNS scans without registration or daily limits.
Summary
ScanSuite's free SPF DKIM checker validates email authentication DNS records including SPF authorized senders, DKIM public key selectors, and DMARC enforcement policies. Detect lookup limit violations, alignment gaps, and weak p=none configurations before spoofing attacks damage your domain reputation.