Free DMARC, SPF & DKIM Checker

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that builds on SPF and DKIM. It lets domain owners specify what to do with emails that fail SPF/DKIM checks: monitor (p=none), quarantine to spam, or reject outright. DMARC drastically reduces email spoofing and phishing.

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email on behalf of your domain. When a server receives an email, it checks the sending server's IP against the SPF record. An ~all (softfail) or -all (hardfail) suffix rejects unauthorized senders.

DKIM (DomainKeys Identified Mail) cryptographically signs outbound email. The public key is published as a DNS TXT record under a selector (e.g. google._domainkey.domain.com). Receiving servers verify the signature matches, proving the email came from an authorized sender and was not tampered with in transit.

Start with p=none to monitor without rejecting, then move to p=quarantine once you're confident legitimate email aligns correctly. Finally switch to p=reject for maximum protection. The rua= parameter sends aggregate reports to help you monitor alignment before tightening policy.

Major providers (Google, Microsoft, Yahoo) use DMARC alignment to determine inbox vs spam placement. From February 2024, Google and Yahoo require DMARC for bulk senders. A strong p=reject policy with SPF and DKIM alignment significantly improves deliverability and protects your brand.