What each record contributes
SPF publishes a domain’s sending policy in DNS. A receiving system can evaluate the connecting sender IP against that policy. This tool does not establish an SMTP connection or evaluate a sender IP. It retrieves the record and highlights observable issues such as multiple policies, malformed common mechanisms and terms that trigger DNS work. External include chains are not expanded, so the displayed count is not a complete SPF lookup budget.
DKIM provides domain-associated signatures for selected parts of an email. Finding a public key in DNS does not prove that a particular message has a valid signature. DMARC depends on the relationship between the visible sender domain and successful authentication results. Since this tool does not inspect an actual message, it cannot establish alignment. Treat these as preliminary checks across three distinct configuration layers.
Looking up a domain
Enter a domain such as example.com, without a URL path or email address. IP addresses are not accepted. The lookup button requests TXT records for the domain itself and its _dmarc name through Google Public DNS. When a selector is supplied, it also requests selector._domainkey. Typing a domain does not start a lookup; network requests require the explicit button action.
A live lookup shares the queried domain and selector name with the public DNS service. It is therefore different from the local analysis mode. A network failure is shown as a query error rather than being converted into a missing record. Public resolver caches may not immediately reflect a recent DNS change. Compare the results with your provider’s verification screen and, when needed, the authoritative DNS response.
Analysing pasted TXT records
Paste records from your DNS management panel into their respective fields, then choose local analysis. Each line represents a separate TXT record. If one record contains several quoted character strings, join those chunks without inserting additional spaces first. Do not merge two separate SPF policies into one line merely to make a warning disappear; the input should reflect the actual published record structure.
The tool flags an SPF +all policy as broadly permissive. DMARC checks include version and policy order, duplicate tags and common value ranges. A p=none policy is described as monitoring rather than invalid. For DKIM, an empty p tag indicates a revoked key. The synthetic example demonstrates that distinction and should never be copied as a real email provider configuration.
Selectors and verification boundaries
A DKIM selector identifies the DNS name holding a particular provider key. Do not assume that every account on a platform uses the same selector. Obtain it from your provider’s administration panel or the s= tag in a real DKIM-Signature header from your own email. Leaving it blank produces a not-checked result; the tool does not conclude that the domain has no DKIM setup.
DKIM public key data receives basic Base64 syntax checks. Cryptographic key structure, RSA bit length and real message signature verification are outside this version. DMARC parent-domain discovery and external reporting destination authorisation are also not performed. A record without an obvious issue has not been certified fully compliant. Use the DNS lookup tool for a broader view of published DNS records.
Using the report responsibly
Use the exact records supplied by your email provider. Before adding a sender, examine how it should fit into the existing SPF policy rather than publishing another independent SPF record. Do not guess include values or publish someone else’s public key. Review legitimate sending sources and real message results before tightening a DMARC policy. This tool makes no changes to DNS and does not send test email.
Copy the findings or download a text report for your own troubleshooting notes. Sharing defaults to the page URL only. If you opt to include inputs, the domain and pasted records are embedded in the link fragment and readable by its recipients. Never enter passwords or private keys. The protocol background comes from SPF RFC 7208, DKIM RFC 6376 and DMARC RFC 7489.
Frequently asked questions
Does a clean report guarantee inbox delivery?
No. Authentication configuration is only one part of a receiving system’s decision. Reputation, content, sending behaviour and recipient policy also matter. This tool does not send a message or test an inbox.
Can DKIM be checked without a selector?
Not with this lookup. An empty selector produces an explicit not-checked result. The tool does not enumerate possible names or infer that no DKIM keys exist for the domain.
Why is the SPF count incomplete?
The count covers DNS-triggering terms in the retrieved or pasted top-level record only. Recursive include and redirect dependencies are not expanded. A displayed value below ten therefore does not establish a passing full SPF evaluation.
Are pasted records sent to a server?
Local analysis processes pasted values in the browser. A live DNS query sends domain names to the public resolver. If you explicitly include inputs when sharing, the generated link also contains those records.