Email Security Checker (SPF, DKIM, DMARC)

What the Email Security Checker (SPF, DKIM, DMARC) checks

Email authentication lets receiving mail servers verify that a message claiming to come from your domain really does. SPF lists the servers allowed to send for the domain, DKIM signs each message with a key published in DNS, and DMARC tells receivers what to do when those checks fail and where to send reports. MTA-STS and TLS-RPT protect and monitor the encryption of mail sent to you.

This checker uses DNS only. It looks up your MX records, parses your SPF record and counts the DNS lookups it triggers, probes DKIM on a list of common selectors, reads your DMARC policy and reporting addresses, and checks for the _mta-sts and _smtp._tls TXT records. It does not send email or connect to your mail servers.

Why it matters

Without these records anyone can send mail that appears to come from your domain, which is the basis of most phishing and invoice fraud aimed at your customers. Large mailbox providers such as Gmail and Yahoo now require SPF, DKIM and DMARC from bulk senders, and unauthenticated mail is more likely to land in spam or be rejected.

SPF has a hard limit of 10 DNS lookups. Every include, a, mx, exists and redirect counts, and nested includes from email services add up quickly. Past the limit, SPF returns a permanent error and stops protecting you. See our guide to email authentication.

How to fix common problems

Publish one SPF record listing every service that sends as you, for example v=spf1 include:_spf.google.com include:amazonses.com -all. Remove services you no longer use, and if you exceed 10 lookups, replace some includes with the provider’s ip4:/ip6: ranges or move a sender to a subdomain.

Turn on DKIM signing in each sending service and publish the keys they give you. Then add DMARC, starting in monitoring mode: _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com". Read the aggregate reports, fix legitimate senders that fail, then move to p=quarantine and finally p=reject. A domain that sends no mail should publish v=spf1 -all and p=reject.

Add MTA-STS and TLS-RPT so mail to you is encrypted in transit and failures are reported; our MTA-STS and TLS-RPT guide shows the records and policy file. The full PerfoMetrix audit adds mail server reverse DNS, blocklist checks, DNSSEC and 170+ other checks.

Questions

Why does the tool say no DKIM was found when I use DKIM?

DKIM keys live under a selector name chosen by your email provider, and selectors cannot be listed through DNS. The tool tries common selectors; if yours is custom, it may not be found. That is reported as information, not a failure.

Is p=none enough?

p=none only monitors. It is the right first step, but spoofed mail is still delivered until you move to quarantine or reject.

Can I have two SPF records?

No. Multiple v=spf1 records on the same name cause a permanent error. Merge them into a single record.

Does this test check whether my mail server supports STARTTLS?

No. It checks DNS records only and never connects to your mail servers.