Check a domain's email authentication, SPF, DKIM and DMARC, and find out why messages land in spam or get spoofed.
SPF, DKIM and DMARC are the three pillars of email authentication. SPF (Sender Policy Framework) declares, in a TXT record, which servers may send email for your domain; since RFC 7208's 10-lookup DNS limit applies to the whole chain (including third-party includes like Google Workspace or marketing platforms), this tool follows nested includes and redirects to count the real total, not just your own record's. DKIM (DomainKeys Identified Mail) cryptographically signs messages with a key published under a selector, either RSA (2048 bits or more) or the newer Ed25519. DMARC ties the two together, telling providers what to do when authentication fails (monitor, quarantine or reject) and where to send reports; since 2024, Google and Yahoo require at least a DMARC record from anyone sending bulk email. When something is wrong, SPF over the limit (even if that only shows up once nested includes are counted), ending in +all, DMARC missing or with a weaker sp than p, or a revoked DKIM key, your legitimate mail goes to spam and scammers can spoof your domain. This tool reads the records over DNS-over-HTTPS, validates each against the RFCs and shows exactly what to fix.
Paste the code into your HTML and the tool shows up on your page, without J-Kit's navigation and ads. It still runs in the browser of whoever visits your site.
<iframe
src="https://jkit.tools/embed/en-US/spf-dkim-dmarc-checker"
width="100%"
height="600"
style="border:0"
loading="lazy"
title="SPF, DKIM & DMARC Checker"
></iframe>These references help contextualize formulas, standards, APIs and limitations used on this page. They do not replace professional validation when a result has legal, financial, medical or operational impact.
SPF authorizes IPs/servers to send for the domain. DKIM signs each message with a cryptographic key, proving it wasn't altered and came from the domain. DMARC defines what to do when SPF or DKIM fail (none, quarantine or reject) and generates reports. The three complement each other: SPF and DKIM authenticate, DMARC enforces the policy and provides visibility.
The tool queries the TXT records for SPF (on the domain), DMARC (at _dmarc) and, if you provide the selector, DKIM. Each record is validated and gets a diagnosis with risks and fixes.
For safety, the browser queries the TXT records directly on a public resolver (Cloudflare) over DNS-over-HTTPS, passing only the name, the J-Kit server is never an intermediary, avoiding SSRF. All record analysis runs locally.