SPF / DKIM / DMARC / MX Checker

SPF / DKIM / DMARC / MX Checker

Email authentication exists because SMTP, the protocol email runs on, has no built-in way to prove who actually sent a message — anyone can put any "From" address on an outgoing email. SPF, DKIM and DMARC are three separate DNS-published policies that, together, let a receiving mail server verify a message is legitimate: SPF lists which mail servers are allowed to send for a domain, DKIM cryptographically signs outgoing mail so it can't be altered in transit, and DMARC tells receivers what to do when a message fails either check, plus where to send failure reports. A domain with none of these configured is easy to spoof; a domain with all three configured correctly is one attackers struggle to impersonate.

SPF (Sender Policy Framework) is a single DNS TXT record starting with "v=spf1" that lists mechanisms — ip4:/ip6: for explicit address ranges, include: to delegate to another domain's own SPF record (common when using a third-party sender like a marketing platform), a/mx to authorize the domain's own A/MX-resolved hosts, and a final "all" mechanism whose qualifier (-, ~, ?, or none) decides what happens to mail from an unlisted source: -all hard-fails it, ~all soft-fails it, and a bare "all" or no "all" at all effectively authorizes anything. This tool expands every include: recursively, showing the full tree of ranges a domain's SPF record actually authorizes — a single top-level record can hide a long chain of delegated senders. RFC 7208 also caps the number of DNS-lookup mechanisms (include/a/mx/ptr/exists, plus a redirect modifier) a compliant SPF evaluator will follow at 10; exceeding it makes the ENTIRE record invalid at real mail servers, a surprisingly common misconfiguration this tool flags explicitly.

DMARC builds on SPF and DKIM rather than replacing either: published as a TXT record at _dmarc.<domain>, its p= tag sets the policy for the domain itself (none/quarantine/reject), sp= optionally overrides that for subdomains, pct= can roll out enforcement gradually, and rua=/ruf= point at addresses that receive aggregate/forensic failure reports — the only real feedback loop a domain owner has into how their domain is being used (or abused) across the wider mail ecosystem. A domain with SPF and DKIM configured but no DMARC record still leaves receivers to decide unilaterally what to do with a failing message.

DKIM is different from the other two: there's no way to discover a domain's DKIM selector(s) by querying DNS directly — a selector is an arbitrary label chosen by whoever configured outbound mail, published only as part of the record name itself (<selector>._domainkey.<domain>). This tool never guesses or enumerates selectors on your behalf — doing so at scale is scanner/enumerator behavior, not something a free, DNS-friendly tool should do unprompted. Enter a selector you already know (check an email's raw headers for a "DKIM-Signature" header's s= tag), or try one of the common provider defaults this page suggests (google, selector1/selector2 for Microsoft 365, k1 for Mailchimp/Mandrill, default, dkim) — each is just a text hint that fills the input, never an automatic background lookup.

This tool is strictly DNS-only: it reads MX, SPF, DMARC and (optionally) one DKIM TXT record, and nothing else. It does not connect to any mail server, does not send a test email, and does not perform an SMTP handshake — that would be an outbound TCP connection this tool deliberately does not make (a genuine "test deliverability" probe is a different, heavier capability tracked separately).

How to use this checker

1. Enter a domain

   Type the domain you want to check, like example.com — not a full email address.

2. Optionally add a DKIM selector

   If you know the DKIM selector (or want to try a common one), enter it — DKIM is only checked when a selector is provided.

3. Check domain

   Click "Check domain" to resolve MX, SPF (with every include: expanded) and DMARC live via DNS.

4. Review the results

   Each section shows what was found, or an honest "not found" — a missing record is a normal result, not an error.

Glossary

SPF

Sender Policy Framework — a DNS TXT record listing which mail servers are allowed to send email for a domain.

DKIM

DomainKeys Identified Mail — a cryptographic signature added to outgoing email, verified against a public key published in DNS at a selector-specific name.

DMARC

A DNS policy record that tells receiving mail servers what to do with mail that fails SPF or DKIM, and where to send failure reports.

MX record

Lists the mail servers responsible for accepting email for a domain, each with a numeric priority — lower values are tried first.

SPF include:

An SPF mechanism that delegates to another domain's own SPF record — common when a domain uses a third-party sender.

DKIM selector

An arbitrary label chosen by whoever configured outgoing mail, forming part of the DKIM record's DNS name — not discoverable without already knowing it.

API equivalent

This page calls our own public tools endpoint under the hood — you can call the same endpoint directly, unauthenticated, subject to a per-caller rate limit. `selector` is optional; the dkim field is entirely absent when it's omitted:

curl "https://ip.xakki.pro/api/v1/tools/mail?domain=example.com&selector=google"

Example response:

{
  "domain": "example.com",
  "mx": [{"host": "mail.example.com", "priority": 10}],
  "spf": {
    "found": true,
    "record": "v=spf1 include:_spf.example.com -all",
    "includes": [{"host": "_spf.example.com", "ip4": ["1.2.3.0/24"]}],
    "lookupCount": 2,
    "spfLookupLimitExceeded": false
  },
  "dmarc": {"found": true, "policy": "reject", "pct": 100},
  "dkim": {"selector": "google", "found": true}
}

Read the full API docs

Related tools

• All free tools
• DNS & Reverse DNS Lookup
• ASN Lookup / Whois
• IP Geolocation API

Frequently asked questions

Why can't this tool find my DKIM record automatically?

DKIM selectors aren't published anywhere except as part of the record's own DNS name, and there's no reverse lookup for them. Automatically guessing dozens of selectors per click would turn a free tool into a domain-enumeration scanner — instead, enter a selector you already know, or try one of the common provider defaults this page suggests.

What does "SPF lookup limit exceeded" mean?

RFC 7208 caps the number of DNS-lookup mechanisms (include/a/mx/ptr/exists, plus a redirect modifier) a compliant mail server will follow while evaluating SPF at 10. Exceeding it makes the entire SPF record invalid at real mail servers — not a partial pass, a full failure — which is why this tool flags it explicitly rather than just showing the raw chain.

Does this tool send a test email or connect to my mail server?

No — it only reads DNS records (MX, SPF, DMARC, and optionally one DKIM record). It never opens an SMTP connection, sends mail, or otherwise touches your mail server directly.

Why does my domain show more than one SPF record?

Publishing more than one v=spf1 TXT record is a real, fairly common misconfiguration — receiving mail servers are required to treat multiple SPF records as a permanent SPF failure, even if each individual record looks valid on its own. Merge them into a single record instead.

Is a missing DMARC record an error?

No — many domains simply haven't published one yet. This tool reports it as a normal "not found" result, not a failure, though a missing DMARC record does mean receiving mail servers decide unilaterally what to do with mail that fails SPF or DKIM for your domain.

Is there a rate limit on this tool?

Yes — this page and its underlying API endpoint share the free tools lane's per-caller rate limit, independent of our main IP lookup API's daily quota. If you need higher volume or programmatic access, our API docs cover the paid tiers.