Free SPF, DKIM & DMARC Checker
To check if a domain has DMARC set up, enter it below: this free checker looks up the DNS TXT record at _dmarc.<yourdomain> and reads its policy, then analyses the SPF record and DKIM alignment too. You get an A+ to F graded breakdown across 7 categories, with clear recommendations you can act on to improve your email security posture. No sign-up needed.
Want to check your primary and alternate brand domains together? Use the Security Grade for a full domain trust assessment across all security layers.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that protects your domain from spoofing, phishing and business email compromise. It builds on SPF and DKIM to give domain owners control over what happens when an email fails authentication.
Why You Need DMARC
- Prevent Phishing: Stop attackers from sending emails that appear to come from your domain.
- Improve Deliverability: Major providers like Google and Microsoft prioritise domains with strong DMARC policies.
- Regulatory Compliance: DMARC is increasingly required by regulations including PCI-DSS v4 and the UK NCSC.
- Brand Protection: Protect your brand reputation from domain spoofing attacks. DMARC stops spoofing of your exact domain, but attackers can also register lookalike domains. Scan for these with our Lookalike Domain Scanner.
UK MSP DMARC Audit: updated quarterly
We used this tool to audit the DMARC posture of 192 UK Managed Service Providers in Q1 2026. Only 5% achieved an Excellent rating when brand domain protection was factored in. The Q2 2026 re-scan grades the same providers A+ to F: the average MSP scores a C and only 6% earn an A. Both reports include regional breakdowns and what the NCSC Mail Check retirement means for UK organisations.
Need Ongoing DMARC Monitoring?
This free tool is perfect for quick checks. But a one-off scan cannot tell you who is sending email as your domain right now. With ShieldMarc monitoring, you get parsed DMARC aggregate reports, sender visibility, alignment tracking, and alerts when something changes. Start a free trial.
Want a complete picture?
Our Security Grade scans DMARC, SPF, SSL/TLS, DNSSEC, registration, and expiry across your primary and alternate brand domains in one click.
Why DKIM has no fixed DNS location
SPF and DMARC are straightforward to look up. SPF sits in a TXT record on the domain itself, and DMARC always sits at _dmarc.yourdomain.com. DKIM does not work that way. A DKIM public key is published at <selector>._domainkey.yourdomain.com, where the selector is an arbitrary label chosen by whoever set the signing up. DNS gives you no way to list the names underneath a domain, so no query returns “every DKIM selector for this domain”. That is why a DKIM lookup asks you for a selector while a DMARC lookup never does, and it is the most common reason people conclude a domain has no DKIM when it does.
Most providers use a predictable default, so checking the handful below identifies signing on the majority of domains. A domain can carry several selectors at once: one for your main mail platform, and one for each marketing, CRM or ticketing tool that sends on your behalf.
Common provider defaults
| Provider | Default selectors |
|---|---|
| Google Workspace | google, google2048 |
| Microsoft 365 | selector1, selector2 |
| Amazon SES | dkim |
| SendGrid | s1, s2, smtpapi |
| Mailchimp / Mandrill | k1, k2, k3 |
| Mailgun | mailo, smtp |
| Postmark | pm, 20230601 |
| HubSpot | hs1, hs2 |
| Salesforce | sf, salesforce |
| Mimecast | mimecast20190104 |
| Proofpoint | proofpoint |
| Zoho Mail | zoho |
| Zendesk | zendesk1, zendesk2 |
| SparkPost | sparkpost |
| Campaign Monitor | cm |
| Klaviyo | kl, kl2 |
| Constant Contact | ctct1, ctct2 |
| Generic or custom | default, email, mail |
Microsoft 365 and several other providers publish the key as a CNAME pointing at their own infrastructure rather than as a TXT record in your zone, so anything reading the key has to follow the CNAME first.
How to read the selector from a signed message
If your provider is not in the table, take the selector from a message you have already sent. Send one to an account you control, then view the raw source: in Gmail that is Show original, and most desktop clients offer something like View source or View message source. Find the DKIM-Signature header, which is a list of tag=value pairs. Two of them matter here: d= is the signing domain and s= is the selector. A header beginning v=1; a=rsa-sha256; d=example.co.uk; s=selector1; tells you the key is published at selector1._domainkey.example.co.uk. A single message can carry more than one DKIM-Signature header, and each one is a separate key worth checking.
What a “not found” result proves
A selector that returns nothing means only that no key is published at that exact name. It does not mean the domain has no DKIM. The selector may be one you have not guessed, the record may have been added to the wrong zone, or the provider may have withdrawn the key after you stopped using the service. Read a negative result as “not found at this name” rather than “not configured”.
The reverse holds as well. A key that resolves does not prove mail is being signed with it, and it does not prove the signature will align. Alignment is what DMARC actually tests: the d= domain in the signature has to match the From domain under the adkim= rule described in the DMARC tags tab. A valid key belonging to an unrelated domain gives you a DKIM record that looks healthy and a DMARC result that still fails.
What the checker above covers
It reads your DMARC record and your SPF record, and scores the adkim= alignment mode your DMARC policy sets. It does not retrieve DKIM public keys, because doing that needs a selector. To look those up, use the DKIM checker, which probes a list of common selectors or any selector you supply and shows the published record for each one it finds. For SPF on its own, including lookup-count problems, use the SPF checker.
What is a DMARC checker?
A DMARC checker is a free tool that looks up the DMARC record in your domain's DNS (at _dmarc.yourdomain.com) and tells you whether it exists, which policy it uses (none, quarantine or reject) and whether it is set up correctly. This checker goes further: it grades your DMARC, SPF and DKIM alignment from A+ to F across 7 categories and adds a plain-English AI explanation of exactly what to fix, with no sign-up needed. For continuous monitoring across many domains, the same engine powers ShieldMarc's paid reporting.
How do I check if my domain has DMARC set up?
DMARC lives in a DNS TXT record at the hostname _dmarc.yourdomain.com. The fastest way is to paste your domain into the checker above, which queries that record and grades it. To check it yourself, run dig TXT _dmarc.yourdomain.com +short on macOS or Linux, or nslookup -type=TXT _dmarc.yourdomain.com on Windows. A configured domain returns a value starting v=DMARC1; if nothing comes back, no DMARC record is published.
How do I look up a DMARC record?
A DMARC record is always a TXT record at the special subdomain _dmarc under your domain, so you look it up by querying _dmarc.yourdomain.com rather than the bare domain. The checker above does this lookup and explains every tag in plain English. The record format is defined in RFC 7489, the original DMARC specification, obsoleted in May 2026 by DMARCbis (RFC 9989).
What is the best free DMARC checker?
The best free DMARC checker is one that reads your policy and explains what to fix, not just whether a record exists. This checker is 100% free with no sign-up: it grades DMARC, SPF and DKIM alignment from A+ to F across 7 categories and adds a plain-English AI explanation of the result. For multi-domain IT teams and UK MSPs that need continuous monitoring of who is sending as your domain, the same engine powers ShieldMarc's paid reporting from £0 to £100 per month.
How do I verify a DMARC record using dig?
Run dig TXT _dmarc.yourdomain.com +short from a terminal. A valid record is returned as a quoted string beginning v=DMARC1; p=.... Watch for two common faults: a record published at the bare domain instead of the _dmarc label, and more than one DMARC TXT record on the same name, which DMARC verifiers treat as no record at all.
How long does it take for a DMARC record to work?
DMARC records take effect as soon as they propagate through DNS, typically within minutes to a few hours. However, you will not start receiving aggregate reports until email receivers process messages sent from your domain, which usually takes 24 to 48 hours.
Should I start with p=none or p=reject?
For domains that actively send email, start with p=none and configure rua= reporting. Monitor your reports for 2 to 4 weeks to identify all legitimate sending sources, then move to p=quarantine and finally p=reject. For domains that do not send email (parked or defensive), go straight to p=reject.
Can DMARC break my email?
A DMARC policy of p=quarantine or p=reject will affect emails that fail authentication. This is why monitoring with p=none first is important: it lets you identify and fix legitimate senders (marketing platforms, CRMs, etc.) before enforcement. Emails sent directly from your mail provider (Google Workspace, Microsoft 365) are almost always aligned and will not be affected.
Do I need both SPF and DKIM for DMARC?
DMARC requires only one of SPF or DKIM to pass and align. However, best practice is to configure both. SPF validates the sending server, while DKIM validates the message content. Having both provides redundancy and improves deliverability.
What is a good DMARC grade?
Our checker grades domains from A+ to F. A or A+ means your domain has strong enforcement with p=reject, strict alignment, and active reporting. Use the Security Grade for a broader assessment that includes SSL, DNSSEC, MTA-STS, and more.
Why does my SPF grade the same with ~all and -all?
For DMARC purposes, both ~all (soft fail) and -all (hard fail) grade the same because DMARC enforcement handles rejection at the policy level. However, the Security Grade evaluates them differently: non-mail domains require strict -all to reach higher trust levels.
How do I find my DKIM selector?
DKIM keys are published at <selector>._domainkey.yourdomain.com, and DNS gives you no way to list the selectors a domain uses, so you either try the common default for your provider or read the selector from a message you have already sent. Open the raw source of that message, find the DKIM-Signature header and read the s= tag; the d= tag beside it is the signing domain. Google Workspace normally uses google, Microsoft 365 uses selector1 and selector2, and SendGrid uses s1 and s2. The DKIM selectors tab above lists the common defaults by provider.
Does this checker retrieve DKIM keys?
Not directly. This checker reads your DMARC record and your SPF record, and scores the DKIM alignment mode (the adkim= tag) that your DMARC policy sets. It does not fetch DKIM public keys, because retrieving one requires a selector and DNS provides no way to discover which selectors a domain uses. For key lookups use the DKIM checker, which probes a list of common selectors or any selector you supply and shows the published record for each one it finds.