Free SPF, DKIM & DMARC Checker
To check if a domain has DMARC set up, enter it below: this free checker looks up the DNS TXT record at _dmarc.example.com and reads its policy, then analyses the SPF record and DKIM alignment too. You get an A+ to F graded breakdown across 7 categories, with clear recommendations you can act on to improve your email security posture. No sign-up needed.
Want to check more than email authentication? Use the Security Grade, which grades a domain A+ to F on up to 16 outside-in checks.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol, published as a DNS record, that builds on SPF and DKIM. It asks receiving mail servers what to do with mail that uses your domain but fails authentication (deliver it, send it to spam or refuse it) and asks them to send you reports. At enforcement, DMARC lets receivers block mail that uses your domain in the From address and fails authentication. It does nothing about lookalike domains or display-name tricks.
Why you need DMARC
- Refuse mail that fakes your domain: At
p=rejectyou ask receivers to refuse mail that fails DMARC, and each receiver makes the final call (RFC 9989, section 5.4). - Deliverability: Mailbox providers such as Google and Microsoft take authentication results, DMARC included, into account when they decide where to deliver mail.
- Government and mailbox provider rules: UK government guidance asks public sector domains to reach
p=reject, and Google, Yahoo and Microsoft require a DMARC record from bulk senders. Our guides to NCSC and Cyber Essentials email security requirements and the 2026 bulk sender requirements give the sources. - Lookalike domains: Attackers can also register a domain that resembles yours, which your DMARC record cannot cover. Scan for these with our Lookalike Domain Scanner.
UK MSP DMARC audit: updated quarterly
We used this tool to audit the DMARC posture of 192 UK Managed Service Providers in Q1 2026. Only 9% achieved an Excellent rating when brand domain protection was factored in. The Q3 2026 re-scan, on 16 October, grades the same providers A+ to F: the average MSP still scores a C and 4% earn an A or A+. Each edition includes a regional breakdown, and the Q1 report covers what the NCSC Mail Check retirement means for UK organisations.
Need ongoing DMARC monitoring?
This free tool is perfect for quick checks. But a one-off scan cannot tell you who is sending email as your domain right now. With ShieldMarc monitoring, you get parsed DMARC aggregate reports, sender visibility, alignment tracking, and alerts when something changes. Start a free trial.
Want a complete picture?
Our Security Grade scans DMARC, SPF, SSL/TLS, DNSSEC, registration, and expiry in one scan.
Why DKIM has no fixed DNS location
SPF and DMARC are straightforward to look up. SPF sits in a TXT record on the domain itself, and DMARC always sits at _dmarc.example.com. DKIM does not work that way. A DKIM public key is published at <selector>._domainkey.example.com, where the selector is an arbitrary label chosen by whoever set the signing up. DNS gives you no way to list the names underneath a domain, so no query returns “every DKIM selector for this domain”. That is why a DKIM lookup asks you for a selector while a DMARC lookup never does, and it is the most common reason people conclude a domain has no DKIM when it does.
Most providers use a predictable default, so checking the handful below identifies signing on the majority of domains. A domain can carry several selectors at once: one for your main mail platform, and one for each marketing, CRM or ticketing tool that sends on your behalf.
Common provider defaults
| Provider | Default selectors |
|---|---|
| Google Workspace | google, google2048 |
| Microsoft 365 | selector1, selector2 |
| Amazon SES | (three, generated for each domain) |
| SendGrid | s1, s2, smtpapi |
| Mailchimp | k2, k3 (k1 on older set-ups) |
| Mailchimp Transactional (Mandrill) | mte1, mte2 (mandrill on older set-ups) |
| Mailgun | mailo, smtp |
| Postmark | pm, 20230601 |
| HubSpot | hs1, hs2 |
| Salesforce | sf, salesforce |
| Mimecast | mimecast20190104 |
| Proofpoint | proofpoint |
| Zoho Mail | (a name you choose) |
| Zendesk | zendesk1, zendesk2 |
| SparkPost | sparkpost |
| Campaign Monitor | cm |
| Klaviyo | kl, kl2 |
| Constant Contact | ctct1, ctct2 |
| Generic or custom | default, email, mail |
Microsoft 365 and several other providers publish the key as a CNAME pointing at their own infrastructure rather than as a TXT record in your zone, so anything reading the key has to follow the CNAME first. We checked the current Amazon SES, Mailchimp, Mailchimp Transactional and Zoho Mail records against each provider's own documentation on 17 October 2026.
How to read the selector from a signed message
If your provider is not in the table, take the selector from a message you have already sent. Send one to an account you control, then view the raw source: in Gmail that is Show original, and most desktop clients offer something like View source or View message source. Find the DKIM-Signature header, which is a list of tag=value pairs. Two of them matter here: d= is the signing domain and s= is the selector. A header beginning v=1; a=rsa-sha256; d=example.com; s=selector1; tells you the key is published at selector1._domainkey.example.com. A single message can carry more than one DKIM-Signature header, and each one is a separate key worth checking.
What a “not found” result proves
A selector that returns nothing means only that no key is published at that exact name. It does not mean the domain has no DKIM. The selector may be one you have not guessed, the record may have been added to the wrong zone, or the provider may have withdrawn the key after you stopped using the service. Read a negative result as “not found at this name” rather than “not configured”.
The reverse holds as well. A key that resolves does not prove mail is being signed with it, and it does not prove the signature will align. Alignment is what DMARC actually tests: the d= domain in the signature has to match the From domain under the adkim= rule described in the DMARC tags tab. A valid key belonging to an unrelated domain gives you a DKIM record that looks healthy and a DMARC result that still fails.
What the checker above covers
It reads your DMARC record and your SPF record, checks the adkim= alignment mode your DMARC policy sets, and looks for DKIM public keys at the common selectors and the ones your mail providers use. A key at any other selector needs its name: enter it in the DKIM checker, which shows the published record for each selector it finds. For SPF on its own, including lookup-count problems, use the SPF checker.
What is a DMARC checker?
A DMARC checker is a free tool that looks up the DMARC record in your domain's DNS (at _dmarc.example.com) and tells you whether it exists, which policy it uses (none, quarantine or reject) and whether it is set up correctly. The ShieldMarc checker goes further: it grades your DMARC, SPF and DKIM alignment from A+ to F across 7 categories, with no sign-up needed, and when you click it adds an AI explanation in plain English of what to fix. For continuous monitoring across many domains, the same engine powers ShieldMarc's paid reporting.
How do I check if my domain has DMARC set up?
DMARC lives in a DNS TXT record at the hostname _dmarc.example.com. The fastest way is to enter your domain in the ShieldMarc checker on this page, which queries that record and grades it. To check it yourself, run dig TXT _dmarc.example.com +short on macOS or Linux, or nslookup -type=TXT _dmarc.example.com on Windows. A configured domain returns a value starting v=DMARC1; if nothing comes back, no DMARC record is published at that name.
How do I look up a DMARC record?
A DMARC record is always a TXT record at the special subdomain _dmarc under your domain, so you look it up by querying _dmarc.example.com rather than the bare domain. The ShieldMarc checker does this lookup and explains every tag in plain English. The record format is defined in RFC 9989 (DMARCbis, May 2026), the current DMARC standard, which replaced the original RFC 7489.
What is the best free DMARC checker?
The best free DMARC checker is one that reads your policy and explains what to fix, not just whether a record exists. The ShieldMarc checker is 100% free with no sign-up: it grades DMARC, SPF and DKIM alignment from A+ to F across 7 categories, and when you click it adds an AI explanation of the result in plain English. For multi-domain IT teams and UK MSPs that need continuous monitoring of who is sending as their domains, the same engine powers ShieldMarc's reporting on self-serve plans from £0 to £130 per month, excluding VAT.
How do I verify a DMARC record using dig?
Run dig TXT _dmarc.example.com +short from a terminal. A valid record is returned as a quoted string beginning v=DMARC1; p=.... Watch for two common faults: a record published at the bare domain instead of the _dmarc label, and more than one DMARC TXT record on the same name, which DMARC verifiers treat as no record at all.
How long does it take for a DMARC record to work?
DMARC records take effect as soon as they propagate through DNS, typically within minutes to a few hours. However, you will not start receiving aggregate reports until email receivers process messages sent from your domain, which usually takes 24 to 48 hours.
Should I start with p=none or p=reject?
For a domain that actively sends email, start with p=none (monitoring only) and a rua= reporting address. Read your reports until they show every legitimate sending source passing DMARC: ShieldMarc's readiness check wants 14 days of reports at each step. Then move to p=quarantine (send fakes to spam) and finally p=reject (refuse fakes), as our guide to moving from p=none to p=reject describes. A domain that does not send email (parked or defensive) can go straight to p=reject.
Can DMARC break my email?
A DMARC policy of p=quarantine or p=reject affects mail that fails authentication. This is why monitoring with p=none first is important: it lets you find and fix legitimate senders, such as marketing platforms and CRMs, before enforcement. Mail sent straight from Google Workspace or Microsoft 365 passes DMARC through SPF once your SPF record includes the provider. Turn on DKIM for your own domain as well, or forwarded mail can fail DMARC at enforcement.
Do I need both SPF and DKIM for DMARC?
DMARC requires only one of SPF or DKIM to pass and align. However, best practice is to configure both. SPF validates the sending server, while DKIM validates the message content. Having both provides redundancy and improves deliverability.
What is a good DMARC grade?
The ShieldMarc checker grades domains from A+ to F. An A needs a reject policy and a valid SPF record ending ~all or -all, and an A+ also needs a reporting address (rua=). Strict and relaxed alignment grade the same. Use the Security Grade for a broader grade that includes SSL, DNSSEC, MTA-STS and more.
Why does my SPF grade the same with ~all and -all?
The ShieldMarc checker grades ~all (soft fail) and -all (hard fail) the same, because both stop unlisted servers passing SPF. We still recommend ~all on a domain that sends mail and publishes DMARC, because some receivers refuse mail on an SPF hard fail before DMARC checks DKIM (RFC 9989, section 7.1), and -all on a domain that sends none. The Security Grade treats them differently on a domain that sends no mail: there, its SPF check passes only with -all.
How do I find my DKIM selector?
DKIM keys are published at selector._domainkey.example.com, where the selector is a label chosen when signing was set up. DNS gives you no way to list the selectors a domain uses, so you either try the common default for your provider or read the selector from a message you have already sent. Open the raw source of that message, find the DKIM-Signature header and read the s= tag; the d= tag beside it is the signing domain. Google Workspace normally uses google, Microsoft 365 uses selector1 and selector2, and SendGrid uses s1 and s2. The DKIM selectors tab on this page lists the common defaults by provider.
Does this checker retrieve DKIM keys?
Yes, at the selectors it can guess. Besides your DMARC record, your SPF record and the DKIM alignment mode (the adkim= tag) your DMARC policy sets, it looks for DKIM public keys at a list of common selectors and at the ones your mail providers use, and shows each key it finds with its type and size. DNS provides no way to discover which selectors a domain uses, so a key at any other selector needs its name: enter it in the ShieldMarc DKIM checker.
- What is DMARC? A complete guide to email authentication
- Why is my DMARC failing? Common causes and how to fix them
- How to fix SPF too many DNS lookups
- DMARC p=none to p=reject: a stage-by-stage rollout runbook
- UK MSP DMARC audit: Q3 2026
- What changed when Mail Check retired, and what to do now
- Free DMARC tools compared: checkers, generators and report viewers