Skip to content
AnyMail

Email authentication checker — SPF, DKIM, DMARC & MX

Enter a domain to see whether receivers like Gmail, Outlook and Yahoo can trust its mail. The checker reads the domain's public DNS records, explains every problem it finds and tells you exactly what to change. Free, no sign-up.

The s= value from a DKIM-Signature header. Leave empty to try common selectors.

AnyMail sets all of this up for you

Host email on your own domain with AnyMail and we generate a 2048-bit DKIM key, the exact MX, SPF and DMARC records to publish, and check them for you until everything passes.

Get started

What the checker looks at

MX - where your mail is delivered

MX records tell other mail servers which hosts accept email for your domain. We check that they exist, that every host resolves to an address, and whether the domain publishes a "null MX" to say it receives no mail at all.

SPF - who may send as you

An SPF record lists the servers allowed to send mail for your domain. We check there is exactly one, that it is valid, how it ends (-all, ~all, ?all or +all), and we follow every include: and redirect= to count the DNS lookups - receivers stop at 10, and a record over the limit fails for every message.

DKIM - a signature on every message

DKIM publishes a public key that receivers use to verify a cryptographic signature on your mail. Give us your selector (the s= value from a DKIM-Signature header) or we try the common ones, then report the key type and length: 2048-bit RSA is the standard, 1024-bit is weak.

DMARC - what to do with mail that fails

DMARC ties SPF and DKIM to the address people actually see in the From line, and tells receivers what to do when both fail. p=none only monitors; p=quarantine or p=reject is what protects your domain from spoofing - and what Gmail and Yahoo expect from bulk senders.

MTA-STS, TLS-RPT and BIMI

Optional extras, reported but not graded. MTA-STS makes other servers deliver to you only over verified TLS, TLS-RPT sends you reports about failed encrypted deliveries, and BIMI lets supporting inboxes show your logo once DMARC is enforced.

How the grade works

A
MX, SPF, DKIM and DMARC all pass.
B
No failures and one warning.
C
No failures but two or more warnings.
D
One of the four checks fails.
F
Two or more checks fail, or the domain does not exist.

MTA-STS, TLS-RPT and BIMI never change the grade.

Privacy

The domains you check are not stored. Results are kept in memory for about five minutes so a shared link loads instantly, then discarded.

Frequently asked questions

What is email authentication?

Email authentication is the set of DNS records - SPF, DKIM and DMARC - that let a receiving mail server check that a message claiming to come from your domain really does. Without them, anyone can send mail that looks like yours, and large providers increasingly send unauthenticated mail to spam or reject it.

Why does the checker say no DKIM key was found when I have DKIM?

DKIM keys live under a selector name that only the sender knows, so a checker can only guess. We try the common ones; if your provider uses a different selector, open a message you sent, find the DKIM-Signature header and enter its s= value in the selector field.

Is ~all or -all better at the end of my SPF record?

Both are fine once DMARC is enforced. -all (fail) tells receivers to reject mail from unlisted servers; ~all (soft fail) marks it as suspicious and leaves the final decision to DMARC, which is the more forgiving choice if you are not sure every sending service is listed. ?all and +all give no protection.

What does "too many DNS lookups" mean for SPF?

Each include:, a, mx, ptr, exists and redirect= in an SPF record - and in every record it includes - costs a DNS lookup. Receivers stop after 10 and treat the record as broken, so SPF then fails for all of your mail. Remove services you no longer use or replace some includes with the IP ranges they stand for.

Should my DMARC policy be p=none, quarantine or reject?

Start with p=none and a rua= report address for a couple of weeks to see which services send mail as you. Once all legitimate mail passes, move to p=quarantine and then p=reject. p=none on its own does not protect the domain.

Do you store the domains I check?

No. Queries are not logged or saved; a result is only kept in memory for about five minutes so that repeated or shared checks are fast. To prevent abuse, each network can run a limited number of checks per minute and per day.