SPF, DKIM & DMARC Checker

They are three DNS records that together prove your email is really from you. SPF lists the servers allowed to send as your domain, DKIM signs each message so it cannot be altered in transit, and DMARC tells receiving mail servers what to do when a message fails those checks. Without all three, anyone can send email that appears to come from your business.

DKIM records are published under a selector, and the selector name differs between mail providers. We probe the selectors your mail provider normally uses plus a list of common ones, but we cannot know a custom selector. If yours is not found, enter your selector in the optional field and run the check again. Your mail platform shows the selector in its DKIM settings.

No. The lookups run in your browser against public DNS-over-HTTPS resolvers, so the domain you type never reaches us. Nothing is sent to Peritus Digital unless you choose to contact us.

p=reject is the goal, because it tells inboxes to throw away forged mail outright. Most businesses start at p=none to collect reports, then move to p=quarantine and finally p=reject once the reports show all legitimate mail is passing. Staying at p=none gives you visibility but no protection.

DNS changes usually apply within minutes, but can take up to a few hours depending on the TTL on your existing records. Re-run this check after you publish a change to confirm it is live.