DMARC/DKIM/SPF validator
Validate DMARC, DKIM and SPF records with detailed policy analysis.
How this tool works
The DMARC/DKIM/SPF validator checks the three core email authentication mechanisms of a domain via DNS TXT lookups. SPF defines which servers may send emails, DKIM signs messages cryptographically, and DMARC specifies what happens to unauthenticated mail. Together they protect against email spoofing and improve deliverability.
Typical use cases
- Check new domain for correct email authentication setup
- After SPF/DMARC changes, validate records are published correctly
- Client domain audit before mail migration
- Root cause analysis when emails land in spam
Frequently asked questions
What happens without DMARC?
Without DMARC, third parties can send emails on behalf of your domain (spoofing). Receiving servers have no policy on how to handle unauthenticated mail.
Which DMARC policy is most secure?
p=reject is most secure — unauthenticated mail is rejected. Start with p=none for monitoring, then p=quarantine, then p=reject.
Which DKIM selectors are checked?
We check the most common: default, google, selector1, selector2, k1, k2, dkim, mail, s1, s2, mxvault, protonmail and more.
Why is my SPF record invalid?
Common causes: more than 10 DNS lookups (include/redirect/a/mx count), missing all mechanism at the end, or multiple SPF records on the same domain.
Do you need all three (SPF + DKIM + DMARC)?
Yes. SPF and DKIM are the authentication mechanisms, DMARC ties them together and defines the enforcement policy. Without DMARC, SPF alone provides little value.
How quickly do DMARC changes take effect?
DNS propagation takes 5 minutes to 48 hours depending on TTL. Most receiving servers re-check on every email — a TTL of 3600 (1h) is standard.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.