Why this matters
SPF, DKIM and DMARC help receivers check whether email using your domain is authorized.
Why email can be forged
Anyone can put your address in an email's From line. DNS records help receivers check whether the message is authorized to use your domain.
- SPF lists the servers allowed to send for your domain.
- DKIM lets your provider sign outgoing mail so receivers can verify it.
- DMARC checks that SPF or DKIM verified a domain matching the visible From address, and says how to handle failures.
SPF or DKIM alone can pass for a different domain while the message still shows your
address. DMARC makes that comparison. A DMARC policy of p=none only monitors;
it asks receivers to block nothing.
What to aim for
p=quarantine is the setting to reach, after monitoring with reports shows
your legitimate senders are covered. It asks receivers to put failing mail in spam;
each receiver decides how to handle it.
Quarantine is far enough for most organizations. p=reject asks receivers to
refuse failing mail, including genuine messages that fail. Mailing lists can cause this:
they relay mail from their own servers while leaving your address in the From line,
and added footers or subject tags can break DKIM too.
What can this check see?
Public DNS records only. We cannot see your email or confirm that outgoing messages are signed correctly. DKIM keys use provider-chosen selector names that DNS cannot list. We try common selectors; a missed key is unconfirmed, not proof it is missing.
Do you store my domain or results?
No results are saved. The check runs in your browser; nothing you type is sent to our server. It asks Google's or Cloudflare's DNS for your records, so that service sees the domain and your internet address. If you follow a link containing your domain, our web server also sees it in the page address.
I fixed it, but the result hasn't changed
New DNS records usually appear within an hour. Edited records can show the old value until their previous cache lifetime (TTL) expires, sometimes a day. Wait, then press Re-check.
Will this stop spam in my inbox?
No. These records help receivers detect forgeries of your domain. Your email provider's spam filter handles incoming junk and phishing.
Who can make the changes?
Send the fix guide to whoever manages your website or email. We cannot administer other organizations' DNS.