01Why check SPF, DKIM and DMARC?
SPF, DKIM and DMARC are three DNS records that prove to mailbox providers that your email is legitimate. Without them, Gmail, Outlook and the others have no way to tell your messages from a forgery: your email lands in spam, and anyone can write on behalf of your domain (phishing, CEO fraud…).
Since February 2024, Gmail and Yahoo require SPF or DKIM from every sender, and all three (with DMARC) above 5,000 emails a day. This tool queries the DNS live through the 1.1.1.1 resolver and analyzes each record — to inspect the raw data, also try our DNS lookup.
02Understanding each record
- MX
- Lists the servers receiving the domain's email, with a priority order. Without MX, the domain cannot receive mail.
- SPF
- A TXT record listing the servers allowed to send email on behalf of the domain. The recipient compares the sender's IP address against this list.
- DKIM
- A cryptographic signature added to each email by the sending server. The public key, published in the DNS under a “selector”, lets the recipient verify the message was not altered.
- DMARC
- A policy stating what to do with email failing SPF and DKIM (nothing, spam, reject) and where to send reports. It is what actually blocks domain spoofing.
03From the command line
The JSON API returns the full analysis (statuses, raw records, DMARC policy…) with open CORS — handy for monitoring:
$ curl "its-my-ip.com/api/email?domain=exemple.fr&selector=google" { "spf": { "status": "ok", … }, "dmarc": { "policy": "reject", … }, … }
04Frequently asked questions
How do I find my DKIM selector?
Send yourself an email from your domain and view its source (“Show original” in Gmail): in the DKIM-Signature header, the selector is the s= value. Common ones: google (Google Workspace), selector1 and selector2 (Microsoft 365), k1 (Mailchimp), s1 and s2 (SendGrid).
Which DMARC policy should I choose: none, quarantine or reject?
Start with p=none and a report address (rua=) to observe for a few weeks who sends on behalf of your domain. Once all your legitimate senders are aligned (SPF or DKIM), move to p=quarantine, then p=reject for full protection. Jumping straight to reject without analysis risks blocking legitimate email.
Why does my email land in spam even though SPF is valid?
SPF alone is not enough: providers also evaluate DKIM, DMARC, the reputation of the sending IP and domain, the message content and recipient engagement. Also check alignment: the domain visible in the From field must match the one validated by SPF or DKIM, otherwise DMARC fails.
SPF, DKIM and DMARC: do I really need all three?
Yes. SPF validates the sending server, DKIM guarantees message integrity, and DMARC builds on both to state what to do on failure — without DMARC, a failing SPF or DKIM often has no consequence at all. Together they have become the standard required by major mailbox providers.
What is DMARC alignment?
DMARC is not satisfied with just a valid SPF or DKIM: the authenticated domain must be aligned with the one shown in the From field. For SPF it is the envelope address domain (Return-Path); for DKIM, the d= domain of the signature. This is what prevents a spammer from using their own valid SPF to spoof your display name.