Email Authentication Checker — SPF, DKIM, DMARC

Email Authentication Checker

Email was designed with no built-in way to prove who a message is from, which is why phishing works. Three DNS-published standards close that gap — SPF, DKIM and DMARC — and this tool fetches and grades all three for a domain, telling you not just whether they exist but whether they are actually configured to stop spoofing.

The three layers

• SPF (Sender Policy Framework) — a TXT record listing which servers are allowed to send mail for your domain. We check it exists, is unique, stays under the RFC 7208 limit of ten DNS-lookup mechanisms (exceed it and SPF silently breaks with a permerror), and ends in a restrictive -all or ~all rather than a wide-open +all.
• DKIM (DomainKeys Identified Mail) — a cryptographic signature added to outgoing mail, with the public key published at selector._domainkey.yourdomain. Because the selector name is chosen by your mail provider, DKIM can only be checked when you supply the selector — so this input is optional.
• DMARC — the policy that ties SPF and DKIM together and tells receivers what to do with mail that fails: p=none (monitor only), p=quarantine (spam folder), or p=reject (block outright). It also enables aggregate reporting via rua=.

Worked example

A domain with v=spf1 include:_spf.google.com ~all, a valid DKIM selector, and v=DMARC1; p=reject; rua=mailto:dmarc@domain is fully protected: unauthorised mail is cryptographically detectable and actively rejected, and you receive reports. Change that DMARC to p=none and the protection evaporates — you can see the abuse in reports but receivers still deliver the spoofed mail.

Why it matters

SPF, DKIM and a DMARC policy of p=none is the most common "we have email security" trap: it looks configured but blocks nothing. Moving to p=quarantine and then p=reject is what actually stops your domain being used in phishing and business-email-compromise attacks — and it is increasingly required by major mailbox providers to reach the inbox at all.

Common mistakes

• Publishing two SPF records — only one is allowed; two cause a permerror that fails the whole check.
• Leaving DMARC on p=none forever — it is a starting point for monitoring, not a destination.
• Exceeding ten SPF lookups by stacking include: statements, which silently disables SPF.