SPF, DKIM & DMARC Checker
Find out in seconds whether someone can send email pretending to be your company. Enter your domain and this checks the public records that decide it — SPF, DKIM, DMARC and more — then explains what each one means in plain English.
What this check looks at
Three DNS records decide whether your domain can be impersonated, and almost every small business has at least one of them wrong or missing. They work together, and each one answers a different question.
| Record | What it answers | What happens without it |
|---|---|---|
| SPF | Which servers are allowed to send email using your domain name. | Receiving systems have no list to check a sender against, so a forgery looks the same as the real thing. |
| DKIM | Was this message genuinely sent by your mail system, and has it been altered on the way? | Messages carry no cryptographic proof of origin, and forwarded legitimate mail is more likely to fail checks. |
| DMARC | What should a receiver actually do when a message claiming to be from you fails the checks above? | Nothing happens. This is the record that turns SPF and DKIM from information into protection. |
The check also looks at MTA-STS and TLS-RPT, which govern whether mail sent to you must travel over an encrypted connection, and DNSSEC, which signs your DNS answers so they cannot be forged in transit. Those three are worthwhile hardening rather than urgent gaps, and the results page says so rather than inflating them into emergencies.
Can someone really send email pretending to be my business?
Yes, and it is easier than most owners expect. The From address on an email is not verified by the protocol itself — it is simply text that the sender writes. Anyone can put your company's domain in it. The only thing that stops a forgery being delivered is a published policy telling receiving mail systems to reject messages that fail authentication.
That policy is DMARC, and it is the record most commonly missing. A domain with a perfectly good SPF record and working DKIM signing, but no DMARC policy, is still impersonable. Receivers can tell the message failed. They just have not been told to care.
The damage from this is rarely dramatic. It is usually an invoice that appears to come from you with different bank details, a request to a supplier that looks like it came from your owner's address, or a customer who receives something offensive apparently from your company. By the time you find out, the recipient has already acted on it.
Why are my emails going to spam or junk?
This is the other question that brings people to a business email security check, and the honest answer is that authentication is part of the picture but not all of it. If your domain fails SPF and has no DKIM signature, you are starting every delivery from a position of suspicion, and fixing that genuinely helps.
The big mailbox providers publish what they expect, and it makes a useful checklist. Gmail and Yahoo ask every sender for:
- SPF or DKIM on the sending domain, and valid forward and reverse DNS (a PTR record) for the sending server;
- a spam-complaint rate below 0.3%. Gmail advises staying under 0.1%;
- an encrypted (TLS) connection when sending, in Gmail’s case.
Send more than 5,000 messages a day to Gmail and the bar rises: SPF and DKIM, a DMARC record (p=none is enough), a From domain that lines up with SPF or DKIM, and one-click unsubscribe on marketing mail. Yahoo sets the same rules for bulk senders, and Microsoft announced similar requirements for Outlook.com in 2025.
But content, sending volume, complaint rates, list quality and the reputation of the IP address you send from all matter too. Anyone who promises that publishing three DNS records will guarantee inbox placement is overselling. What these records do is remove a reason for receivers to distrust you — a necessary step, not a complete solution.
If this check comes back clean and your mail still lands in spam, look next at your complaint rate (Google Postmaster Tools shows it for Gmail), any sudden jump in how much you send, whether your sending IP is on a blocklist (see below), and how your mailing list was collected. Sources: Gmail sender guidelines, Yahoo sender best practices, Microsoft’s Outlook.com announcement.
What about BIMI and blacklists?
This check does not test either, and it is worth knowing why they live somewhere else.
BIMI is the standard that shows your logo next to your messages in inboxes that support it. It is built on top of DMARC: your policy has to be at quarantine or reject before BIMI is honoured, and Gmail also requires a paid mark certificate (a VMC or CMC). So the DMARC result above already tells you whether you have cleared the first hurdle. A domain still at p=none cannot use BIMI yet.
Blacklists, also called blocklists or DNSBLs, mostly list the IP addresses that mail is sent from, not a domain’s DNS records. If you send through Microsoft 365, Google Workspace or a mailing service, those addresses belong to the provider, and a listing is theirs to resolve. If your mail is bouncing with a message that names a blocklist, that message is the most reliable place to start, followed by your provider’s support.
What SPF, DKIM and DMARC do not do
They do not reduce the spam arriving in your inbox. This is the single most common misunderstanding, and it is worth being clear about because it changes what you should do next.
SPF, DKIM and DMARC are all about mail sent using your domain. They protect the people who receive email from you. Filtering what arrives in your own mailboxes is a completely separate job, handled by anti-spam and anti-phishing settings inside Microsoft 365, Google Workspace, or whatever hosts your mail. If your actual complaint is the volume of junk you personally receive, this check will not fix it, and we would rather tell you that now than after you have paid someone.
They also do not stop look-alike domains. If an attacker registers yourcompany-invoices.com and sends from that, your DMARC policy has no say — it only governs your own domain. Nor do they help if someone's mailbox password is stolen and mail is sent from inside your real account, which is how most small businesses are actually compromised.
A note on how this check works
The checker calculates results in your browser. DNS queries for the domain you enter go to Cloudflare, with Google as a fallback; those providers receive the queried names. The page also loads advertising and analytics. No account is required. Provider data handling is governed by their policies. Read the StashGrid privacy policy.
That also means the check is limited to what is public. It cannot see inside your Microsoft 365 or Google Workspace tenant, so it says nothing about your mailbox security settings, multi-factor authentication, admin accounts or forwarding rules. Those need authorised access and are a different kind of review entirely.
One limitation is worth stating plainly, because other tools gloss over it. DKIM keys cannot be enumerated from DNS. A key is published under a name called a selector, and there is no way to ask a domain which selectors it uses. This tool tries the selectors used by the major mail platforms. If your domain uses a custom one, the result will say no key was found at the selectors checked — not that DKIM is missing — and those points are excluded from your score rather than counted against you.
Frequently asked questions
Can someone send email pretending to be my business?
If your domain has no DMARC policy set to quarantine or reject, then yes. Anyone can put your domain in the From address and most receiving systems have no instruction telling them to stop it. SPF and DKIM alone do not prevent this — DMARC is the part that tells receivers what to do when those checks fail.
Do SPF, DKIM and DMARC stop the spam I receive?
No. They govern email sent using your domain name and protect the people who receive mail from you. Reducing junk arriving in your own inbox is a separate matter, handled by filtering settings inside your mail platform.
Is my data stored when I run this check?
The checker calculates results in your browser. DNS queries for the domain you enter go to Cloudflare, with Google as a fallback; those providers receive the queried names. The page also loads advertising and analytics. No account is required. Provider data handling is governed by their policies.
Why does it say DKIM could not be verified?
DKIM keys live under a selector name, and DNS provides no way to list which selectors exist. We try the selectors used by the common platforms. A domain using a custom selector shows as unverified even though DKIM is working — which is why we say no key was found at the selectors checked, and exclude those points from the score.
What does a DMARC policy of p=none mean?
It means DMARC is watching but not acting. Receivers report on failures but deliver the mail anyway. It is the right place to start, because it lets you find legitimate senders before blocking anything — but a domain left at p=none is not protected from impersonation.
What is the SPF 10-lookup limit?
SPF evaluation is capped at ten DNS queries. Each include, a, mx, ptr, exists and redirect entry costs at least one, and services chain to more behind the scenes. Over the limit, receivers return a permanent error and your SPF record stops working entirely — even though it looks perfectly normal.
Does this check BIMI?
No. BIMI shows your logo next to your messages in supporting inboxes, but it only works once your DMARC policy is at quarantine or reject, and Gmail also requires a paid mark certificate (a VMC or CMC). The DMARC result here tells you whether you have cleared the first requirement.
Does this check whether my domain is on a blacklist?
No. Most blocklists list the IP addresses mail is sent from rather than a domain's DNS records, and if you send through Microsoft 365, Google Workspace or a mailing service those addresses belong to your provider. If a bounce message names a blocklist, that message and your provider's support are the best places to start.
Why are my emails going to spam even though SPF, DKIM and DMARC pass?
Because authentication only proves a message really came from you; it says nothing about whether people want it. Gmail and Yahoo also weigh spam-complaint rates (keep them below 0.3%; Gmail advises under 0.1%), sending volume, the reputation of your sending IP and domain, and content. If this check is clean, start with your complaint rate in Google Postmaster Tools and whether your sending IP is on a blocklist.