SPF / DKIM / DMARC Checker

Checks DNS via DNS-over-HTTPS (Cloudflare with Google fallback).

Domain

DKIM selectors (comma-separated)

SPF checking…

—

DKIM checking…

—

DMARC checking…

—

Website reachability checking…

—

This page can check HTTPS directly. Browsers block active HTTP checks from an HTTPS page. Use the links provided to try HTTP/HTTPS manually if needed.

Attention!

SPF doesn’t protect the visible “From:” header and is often broken by forwarding. DMARC relies on alignment and usually DKIM for resilience across forwards.
DMARC p=none is monitoring only — real protection comes with quarantine or best: reject.
SPF 10-lookup limit: each include:/a/mx/ptr/exists can add lookups. Too many ⇒ “permerror”.
DKIM key length: prefer 2048-bit keys; short keys weaken protection.
DMARC alignment: consider strict adkim=s; aspf=s once all legitimate senders are configured.

These tips echo guidance from CERT-style best practices for sender authentication.

Disclaimer: This tool was created by ChatGPT and is inspired by CERT’s “Bezpieczna Poczta”. It’s a simple helper for verifying public DNS (SPF/DKIM/DMARC). It is not a professional security tool or a deliverability guarantee.

How it works

When you click Check, the page issues DNS-over-HTTPS queries (Cloudflare first, Google fallback).
SPF is read from TXT at the apex (e.g., example.com, value starting v=spf1).
DMARC is read from _dmarc.example.com (value starting v=DMARC1).
DKIM is read from <selector>._domainkey.example.com. DNS cannot list selectors, so you provide a list; the tool accepts TXT or CNAME-style DKIM publishing.
Website check: the page attempts an HTTPS fetch to see if the site responds. Active HTTP probes are blocked by browsers from an HTTPS context; quick test links are provided instead.
The tool doesn’t store or send your data anywhere; it only reads public DNS and attempts a reachability check from your browser.

Generated by ChatGPT.