Email Authentication Checker

Check a domain’s SPF, DKIM and DMARC records. Public DNS only - nothing connects to the domain’s mail servers.

See whether a domain publishes SPF, DKIM and DMARC records, and whether they’d actually stop someone sending email in its name.

Add a DKIM selector

Find it in the s= tag of a DKIM-Signature header on an email from this domain. Without one, we try a list of common selectors.

How this check works

Your browser asks a public DNS-over-HTTPS resolver (Cloudflare, falling back to Google) for the domain’s published TXT and MX records. These are the same lookups every mail server on the internet makes when it receives an email. No ports are probed and no connection is made to the domain’s own infrastructure.

Domains you check aren’t sent to or stored by Cyberspace Protection. The resolver operator sees the queries, under its own privacy policy.

DKIM can only be confirmed when the selector is known. If no common selector matches, that doesn’t mean DKIM is missing.

Need a wider review? See our Cyber Risk Assessment or contact us.