scan.now
Premium Scan a site

Check a Domain's SPF, DKIM and DMARC Records

Looks up SPF, DMARC and DKIM records, MX hosts, DNSSEC signing and CAA restrictions for a domain, and explains what each gap lets an attacker do.

Public hosts only. About a handful of requests, usually finished in under 15 seconds. How we scan · Acceptable use

Illustration of the email security checker (spf, dkim, dmarc) in use

How it works

  1. Enter the domain

    We resolve the registrable domain (example.co.uk, not mail.example.co.uk).

  2. DNS lookups only

    SPF and DMARC are parsed; 40 common DKIM selectors are probed; DS records reveal DNSSEC.

  3. Move to enforcement

    The report tells you whether DMARC is actually rejecting spoofed mail or only watching it.

What this tool checks

8 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

DNS and email authentication

8 checks

The ones that most often decide the grade:

Medium SPF recordThe domain publishes no valid SPF record, or publishes more than one, so receiving mail servers cannot tell which... High SPF record is too permissiveThe SPF record ends in +all or ?all, omits the all mechanism, or authorises very large address ranges, so a forged... Medium DMARC recordNo DMARC record is published at _dmarc.<domain>, or the record is malformed. Receivers have no instruction on what... Low DMARC policy is p=none (monitoring only)The DMARC record exists but uses p=none, so receivers are asked to deliver spoofed mail normally. Monitoring is the... Info DKIM selector discoveredNo DKIM public key was found under the common selector names, or the key found is weak or revoked. Without DKIM,... Info MX recordsA review of the domain's MX records: Whether mail is deliverable, whether every mail host resolves, and whether a...

After this one, most people run Website Scanner, SSL / TLS Checker, or Security Headers. Each answers a different question about the same thing, and the full list of tools explains which to reach for when. Every finding links through to the checks reference.

Guides for this tool

Background reading written to go with these results.

9 min read · Updated Sep 10, 2026 SPF, DKIM and DMARC Explained: Stopping Email Spoofing of Your Domain

Without SPF, DKIM and DMARC anyone can send email that appears to come from your domain. What each record does, how to write them, how...

Read the guide 8 min read · Updated Sep 13, 2026 How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work

Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...

Read the guide 6 min read · Updated Sep 16, 2026 Secure DNS (DoH and DoT): Stopping Your ISP and Network From Seeing Every Site You Visit

Every website visit starts with a DNS lookup, and by default it is sent in plain text. DNS over HTTPS and DNS over TLS, what they hide,...

Read the guide

Frequently asked questions

My domain sends no email. Do I still need SPF and DMARC?

Yes. A domain with no records can be spoofed freely. Publish v=spf1 -all and a DMARC record with p=reject.

Why can't you find my DKIM record?

DKIM lives under a selector name only you and your mail provider know. We try 40 common ones; a custom selector will not be found, which does not mean it is missing.

What is the difference between p=none and p=reject?

p=none asks receivers to report failures and deliver anyway. p=reject asks them to refuse the message. Only reject and quarantine actually stop spoofing.

How many DNS lookups can SPF use?

Ten, per RFC 7208. More than that and receivers return a permanent error, which is treated like no SPF at all.