scan.now
Premium Scan a site

Check a Domain's SPF, DKIM and DMARC Records

Looks up SPF, DMARC and DKIM records, MX hosts, DNSSEC signing and CAA restrictions for a domain, and explains what each gap lets an attacker do.

Public hosts only. About a handful of requests, usually finished in under 15 seconds. How we scan · Acceptable use

How it works

Enter the domain

We resolve the registrable domain (example.co.uk, not mail.example.co.uk).

DNS lookups only

SPF and DMARC are parsed; 40 common DKIM selectors are probed; DS records reveal DNSSEC.

Move to enforcement

The report tells you whether DMARC is actually rejecting spoofed mail or only watching it.

What this tool checks

8 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

DNS and email authentication

8 checks

The ones that most often decide the grade:

Medium SPF recordThe domain publishes no valid SPF record, or publishes more than one, so receiving mail servers cannot tell which...
High SPF record is too permissiveThe SPF record ends in +all or ?all, omits the all mechanism, or authorises very large address ranges, so a forged...
Medium DMARC recordNo DMARC record is published at _dmarc.<domain>, or the record is malformed. Receivers have no instruction on what...
Low DMARC policy is p=none (monitoring only)The DMARC record exists but uses p=none, so receivers are asked to deliver spoofed mail normally. Monitoring is the...
Info DKIM selector discoveredNo DKIM public key was found under the common selector names, or the key found is weak or revoked. Without DKIM,...
Info MX recordsA review of the domain's MX records: Whether mail is deliverable, whether every mail host resolves, and whether a...

How SPF, DKIM and DMARC work together

Email authentication is a chain: SPF and DKIM supply authenticated identities, while DMARC aligns one of them with the address recipients can see.

SPF lists the systems allowed to send mail for an envelope domain. DKIM lets a sending service sign selected message content with a key published in DNS. DMARC checks whether a passing SPF or DKIM identity aligns with the visible From domain, then tells receivers whether failures should be monitored, quarantined or rejected.

Scan.now retrieves and parses the public DNS records, follows SPF includes within the protocol limit, probes common DKIM selectors and reports the domain's MX, DNSSEC and CAA posture. It does not send a test message, so a custom DKIM selector can remain undiscovered even when DKIM is configured correctly.

Normalise the domainUse the registrable domain rather than an arbitrary mailbox hostname.
Read DNS policiesParse SPF, DMARC, common DKIM selectors, MX, DS and CAA records.
Explain spoofing riskShow whether failures are monitored or actively rejected.

Put this result in context

This scanner answers one part of the review. Continue with Website Scanner for headers, tls, cookies, exposed files, then LLM API Key Scanner for openai, anthropic, gemini and other ai keys. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read SPF, DKIM and DMARC Explained: Stopping Email Spoofing of Your Domain and How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work. The SPF record check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

Email authentication records explained

No single record provides complete impersonation protection.

RecordQuestion it answersStrong baseline
SPFWhich servers may send for the envelope domain?One valid policy, ten or fewer DNS lookups, and a deliberate hard-fail ending.
DKIMWas signed message content authorised by a domain and unchanged in transit?Modern key size, active selector rotation and signatures on every legitimate stream.
DMARCDoes a passing identity align with the visible From domain?Alignment plus quarantine or reject after reports confirm legitimate sources.
MXWhich servers receive mail for the domain?Only intended providers, or an explicit no-mail posture for non-mail domains.
DNSSEC and CAAAre DNS answers signed, and which authorities may issue certificates?Valid DS signing and a narrow certificate-authority policy where operationally supported.

What the email-security result means

The important distinction is whether the domain merely observes spoofing or asks receivers to stop it.

Enforced authentication

SPF is valid, a DKIM selector is visible and DMARC requests quarantine or rejection with aligned legitimate mail.

Spoofing gap

A missing or invalid record, permissive SPF ending or absent DMARC policy can make impersonation easier.

Monitoring stage

DMARC p=none collects reports but normally asks receivers to deliver failures. It is a rollout stage, not enforcement.

Move from visibility to enforcement

  • Inventory every legitimate sender before tightening SPF or DMARC.
  • Enable DKIM for each provider and rotate selectors without removing old keys too early.
  • Review aggregate DMARC reports, correct alignment, then progress from none to quarantine and reject.
  • Publish restrictive SPF and DMARC policies even for domains that intentionally send no email.

What this result does not prove

  • A custom DKIM selector may not be found because selectors are not discoverable through a standard DNS index.
  • DNS records show published policy, not whether every outgoing message is signed or aligned correctly.
  • Forwarding, mailing lists and provider-specific processing can affect authentication after the original send.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Website Vulnerability Scanner

Headers, TLS, cookies, exposed files
LLM API Key Exposure Scanner

OpenAI, Anthropic, Gemini and other AI keys
SSL / TLS Checker

Certificate, expiry, protocols, ciphers
Security Headers Checker

CSP, HSTS, frame and MIME policies

Guides for this tool

Background reading written to go with these results.

9 min read · Updated Sep 10, 2026 SPF, DKIM and DMARC Explained: Stopping Email Spoofing of Your Domain

Without SPF, DKIM and DMARC anyone can send email that appears to come from your domain. What each record does, how to write them, how...

Read the guide
8 min read · Updated Sep 13, 2026 How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work

Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...

Read the guide
6 min read · Updated Sep 16, 2026 Secure DNS (DoH and DoT): Stopping Your ISP and Network From Seeing Every Site You Visit

Every website visit starts with a DNS lookup, and by default it is sent in plain text. DNS over HTTPS and DNS over TLS, what they hide,...

Read the guide

Frequently asked questions

My domain sends no email. Do I still need SPF and DMARC?

Yes. A domain with no records can be spoofed freely. Publish v=spf1 -all and a DMARC record with p=reject.

Why can't you find my DKIM record?

DKIM lives under a selector name only you and your mail provider know. We try 40 common ones; a custom selector will not be found, which does not mean it is missing.

What is the difference between p=none and p=reject?

p=none asks receivers to report failures and deliver anyway. p=reject asks them to refuse the message. Only reject and quarantine actually stop spoofing.

How many DNS lookups can SPF use?

Ten, per RFC 7208. More than that and receivers return a permanent error, which is treated like no SPF at all.