SPF, DKIM and DMARC checker
Three records decide whether your mail is trusted. This shows you what a domain publishes today, quotes it, and explains what each part asserts — without giving you a score out of ten.
The domain you type is used for the lookup and then forgotten: it is not stored and not written to any log. Only a count of how often the tool was used is kept.
The three records, in one paragraph each
SPF is a list of the servers allowed to send mail for your domain, published as a TXT record starting v=spf1. A receiving server compares the sending server against the list. The last mechanism decides what happens to everything not on it: -all means reject, ~all means treat as suspicious, ?all asserts nothing, +all authorises the entire internet and is almost always a mistake.
DKIM is a signature. Your sending server signs each message with a private key, and the matching public key is published in DNS at selector._domainkey.yourdomain. A receiver recomputes the signature and knows the message was not altered in transit. The selector is chosen by whoever sends your mail, which is why it cannot be discovered from DNS.
DMARC ties the two together and says what to do when they fail: a TXT record at _dmarc.yourdomain with a policy of none, quarantine or reject, and optionally an address to send aggregate reports to. Without DMARC, a receiver decides for itself what a failure means.
Why DKIM sometimes shows nothing
Because there is no way to ask DNS “which selectors exist for this domain”. A DKIM key lives at a name built from a selector the sender chose — default, google, selector1, s1, k1 and so on — and you have to know the name to look it up.
This tool tries a list of the common ones and tells you which it tried. Nothing found is therefore not proof that there is no DKIM: ask your provider which selector it signs with, type it into the selector field, and look again. If your provider publishes a CNAME at that name pointing into their own zone, which many do, the lookup still resolves.
- A selector is part of the sending setup, not of the domain.
- Several selectors can coexist — one per sending service.
- Rotating a key means publishing a new selector, not editing the old record.
Reading the result without over-reading it
This tool quotes the records and points out what their own syntax says. It does not grade your domain, because a grade would be a guess about your intent: a small domain that sends nothing at all is perfectly well served by an SPF record with -all and a DMARC policy of reject, and a large sender mid-migration may have excellent reasons for p=none.
Two things are worth knowing regardless. SPF allows ten DNS lookups while evaluating a record, and a long chain of include: mechanisms can exceed it, at which point the record fails for everybody. And a DMARC record with no rua address means you receive no reports, so you will never find out that a service you use is failing.
None of this changes how Mailbind sends your mail. Mailbind sends through your own provider’s SMTP server, so your domain’s SPF alignment and DKIM signing are exactly what they already were — which is precisely why it cannot improve them either.
What this tool keeps
Nothing. The domain and the selector are used for the lookups and then forgotten: not stored, not logged. Only an aggregate count of how often the tool ran is kept.
There is a budget per caller per hour, because a DKIM check makes a dozen DNS queries and a resolver should not be used as a scanner from a marketing page.
Common questions
Why can you not find my DKIM key?
DKIM keys live at a name built from a selector that cannot be discovered from DNS. The tool tries the common selectors and lists them; ask your provider for yours and enter it in the selector field.
Should my DMARC policy be reject?
Eventually, usually — but move there deliberately: start at p=none with a reports address, read the reports until nothing legitimate is failing, then tighten. This tool will not tell you to flip it today.
Does Mailbind affect these records?
No. Mailbind sends through your provider’s own server, so your SPF and DKIM situation is unchanged by using it.
Do I need an account?
No. Every tool here works without signing in, and none of them asks for your mailbox password — they work on a domain name or on text you paste.
Keep reading
Sending from the right address matters too
Mailbind replies from the mailbox that received the message, through that domain’s own server.
Start freeFree plan, two mailboxes, no card.
Page updated October 29, 2026