SPF DKIM DMARC Checker Online

Audit a domain’s email setup: MX, SPF (with the 10-lookup limit), DKIM keys, DMARC policy, MTA-STS, TLS-RPT and BIMI, with a score and what to fix.

Result

Press “Run” to see the result.

The email authentication API checks whether a domain is set up to deliver email and to resist spoofing, the requirements Gmail, Yahoo and Outlook now enforce for bulk senders. It reads the MX records, the SPF record (detecting duplicates, +all / ?all, deprecated ptr and counting the DNS lookups through every include against the limit of 10), DKIM keys at your selectors or at about 20 common ones (Google, Microsoft 365, Mailchimp, SendGrid, Resend, Zoho…), with their key size, and the DMARC policy with its reporting addresses.

Optional records are reported too: MTA-STS and TLS-RPT for encrypted delivery and BIMI for a brand logo in the inbox. Every finding is a check with a status (pass, info, warn, fail) and a message in English or Vietnamese (lang=vi) that says what to change; the score from 0 to 100 and the A–F grade give a quick overview.

DKIM selectors are not discoverable in DNS: if your provider uses a custom one, read the s= tag of the DKIM-Signature header of a sent email and pass it as selectors=. Records are read live through DNS-over-HTTPS (cached for 5 minutes).

Use this in your code

curl "https://apibox.io.vn/v1/email-auth?domain=github.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/email-auth?domain=github.com', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/email-auth?domain=github.com",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/email-auth?domain=github.com');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Why does SPF fail with too many lookups?

RFC 7208 allows at most 10 DNS lookups (include, a, mx, ptr, exists, redirect) to evaluate SPF; beyond that receivers return permerror and SPF fails. The API counts them recursively; remove unused includes or flatten them.

Is p=none enough?

It satisfies the minimum requirement of Gmail and Yahoo but does not stop spoofing. Read the reports (rua=) and move to p=quarantine or p=reject.

The DKIM check says nothing was found, but I sign my email.

Your provider probably uses a custom selector. Find the s= value in the DKIM-Signature header of a received email and pass selectors=that-value.