Home / Free tools / Authentication checker

Email authentication checker

Paste up to 25 sending domains. We check SPF (including the 10-DNS-lookup limit), DKIM, DMARC and MX for every one, and tell you what to fix. Nothing is sent.

Updated 2026-10-18

DomainOverallMXSPFDKIMDMARC

What this checks

  • MX: can the domain receive replies and bounces?
  • SPF: is there exactly one record, how does it end (-all, ~all, ?all or the dangerous +all), and how many of the 10 allowed DNS lookups does it use? Going over 10 makes SPF fail outright, and it's the most common SPF mistake on domains with several sending tools.
  • DMARC: is a record published, what's the policy (none, quarantine or reject), and is there a reporting address?
  • DKIM: we look for a key at about 24 common selectors (google, selector1, k1, s1, default and more) plus any you add.
DKIM selectors can't be listed from DNS, so "not found" means "none at the selectors we tried", not "you have no DKIM". If your sending tool tells you its selector, type it in the box and check again.

Why it matters for cold email

Gmail and Yahoo expect bulk senders to authenticate with SPF and DKIM and to publish a DMARC record, and mail from an unauthenticated domain is more likely to be filtered or rejected. If you send from many domains, one forgotten record on one of them is enough to hurt that domain's mail. Check them all before you start sending, and again after you add or change a tool.

Authentication only tells receivers who you are. It doesn't keep your bounce rate down: that takes a clean list. Verify your leads before you send, and see how many bounces it takes to burn a domain.

Related