Tool 2.2

Email security checker (SPF, DKIM, DMARC)

Check a domain's SPF, DKIM, DMARC, MTA-STS, BIMI and DNSSEC, and get copy-ready DNS records for what's missing or wrong. Lookups go to Cloudflare's public DNS.

Online checkPublic DNS lookups for the domain go from your browser to Cloudflare (cloudflare-dns.com). We store nothing.

An automated check; it doesn't guarantee security.

How to use it

Type a domain, for example `tienda-ejemplo.co`.
Optionally add the DKIM selector your email provider uses.
Press Check and review each row: green is good, amber needs attention, red is missing or unsafe.
Under Copy-ready records, copy each suggested SPF, DMARC or DKIM record and paste it where your domain's DNS is managed, as shown.

What SPF, DKIM and DMARC do for a small business

Without SPF, DKIM and DMARC, anyone can send a message that shows facturacion@tu-empresa.co as the sender. That's how fake invoices and “we changed our bank account” emails reach your customers in your name. The same records also help your real email reach the inbox: since 2024, Gmail and Yahoo ask everyone who sends to them to set up SPF or DKIM, and large senders to add DMARC too.

In plain words: SPF is the list of servers allowed to send for your domain. DKIM is a digital signature on each message. DMARC tells receiving servers what to do with mail that fails both, and where to send reports. MTA-STS, TLS-RPT and BIMI are optional extras, and DNSSEC signs your DNS answers so they can't be faked. All of them are public DNS records, which is why the check needs nothing but the domain.

A shop on Google Workspace with p=none

Check tienda-ejemplo.co. Its MX points to Google, so the page says your email is hosted at Google Workspace. SPF is v=spf1 include:_spf.google.com ~all: green, with the number of DNS lookups it uses out of the limit of 10. DKIM is found for the selector google. DMARC is v=DMARC1; p=none; rua=mailto:dmarc@tienda-ejemplo.co, in amber: monitoring only. DNSSEC is not signed. Two of the four core protections pass, so the grade is C.

Under Copy-ready records you get the next DMARC step, v=DMARC1; p=quarantine; rua=mailto:dmarc@tienda-ejemplo.co, to paste as a TXT record at _dmarc once 2 to 4 weeks of reports show that all your real email passes SPF or DKIM.

Common mistakes it catches, and what it can't see

Adding a second SPF record when you sign up for a newsletter or billing service, instead of editing the one you have: with two, SPF fails, and the page offers a single merged record. Going over 10 DNS lookups by stacking includes. Jumping straight to p=reject before every service that sends in your name, like your invoicing or store software, passes the checks, which can block your own invoices.

The check reads public DNS only. It can't see whether a particular email passed or failed; for that, read your DMARC reports or the message headers. It finds DKIM only under the selectors it knows or the one you type, so “not found” can just mean an unusual selector.

FAQ

What is DMARC and why does it matter?

DMARC tells receiving mail servers what to do with messages that fail SPF and DKIM. With p=quarantine or p=reject, servers that check DMARC, such as Gmail and Outlook, send forged mail that uses your exact domain to spam or refuse it. It doesn't stop look-alike domains, such as tu-empresa-pagos.co.

Why is DKIM shown as not found?

DKIM keys live under a 'selector' name chosen by your email provider. We detect your provider from its MX records and try its selectors plus the most common ones; if yours is different, type it in the optional field.

Is my domain sent to eThorns?

No. The lookups go from your browser straight to Cloudflare's public DNS resolver (1.1.1.1).

What's the difference between ~all and -all in SPF?

Both close the list of allowed servers. `~all` (soft fail) asks receivers to treat mail from other servers as suspicious; `-all` (hard fail) asks them to reject it. Once DMARC is in place, its policy decides what happens, so `~all` is a fine and safer choice while you're still finding every service that sends for you. The page marks both as good.

My domain doesn't send email. Do I still need this?

Yes, because scammers like unused domains too. If it has no mail servers (no MX), the page suggests two records: `v=spf1 -all`, which says no server may send for it, and `v=DMARC1; p=reject;`, which tells receivers to refuse anything that claims to come from it. A domain with neither is easy to spoof.

Guides for this tool

G3How to set up DMARC in one day: SPF, DKIM and DMARCA one-day plan to set up SPF, DKIM and DMARC for your business domain, check them with free tools, and reach p=reject in the weeks after.
G14Why are my emails going to spam? A fix for small businessesWhy a small business's email lands in spam: SPF, DKIM and DMARC, the Gmail and Yahoo sender rules, common setup mistakes, and how to check yours.
G24How to read email headers and spot a fake emailFind an email's raw headers in Gmail, Outlook or Apple Mail, read the Received lines and the SPF, DKIM and DMARC results, and spot a fake sender.
G25How to read your first DMARC report, line by lineWhat each part of a DMARC aggregate report means, why your own services may fail, how to tell a forwarder from a spoofer, and the road to p=reject.

2.1What's my IP?See your public IP address, whether it's IPv4 or IPv6, your country, TLS and HTTP version, and what every website can learn from your connection.
2.3SPF record builderBuild one SPF record for your domain from your mail services, servers and IP ranges.
2.4DNS lookupLook up any domain's DNS records (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV) or the reverse DNS of an IP, with TTLs and DNSSEC validation.
2.5Email header analyzerPaste an email's raw headers to see the servers it passed through, the SPF, DKIM and DMARC results your provider recorded, and signs of a forged sender.
2.6DNS propagation checkerAsk 10 public resolvers (Google, Cloudflare, Quad9, OpenDNS…) for a name's A, AAAA, CNAME, MX, NS or TXT records and see if your DNS change reached them.
2.7DMARC report readerOpen a DMARC aggregate report (.xml, .xml.gz or .zip) and see, for each sending IP, how many messages passed or failed SPF and DKIM.
2.8Is it down?Check whether a website answers, with its HTTP status, response time, redirects and HTTPS, measured once from our server in Colombia.
2.9DMARC record generatorBuild a DMARC TXT record: policy, test mode, report addresses and alignment.
2.10Link preview checkerSee how your link will look when shared on WhatsApp, X, LinkedIn or Facebook: check the title, description, og:image and Twitter card tags, with fixes.
2.11Subnet calculatorType an IP address with its prefix to get the network, mask, broadcast, usable host range and count, and split it into equal subnets.

╌╌ END ╌╌