Email Security Checker: How to Check SPF, DKIM and DMARC
Email is essential for business communication, customer support, invoices, and marketing. However, attackers can exploit email to impersonate trusted companies, send phishing messages, and trick employees into sharing sensitive information.
A properly configured email security system helps protect your domain from email spoofing and improves confidence in your business communications. One important step is checking your domain’s SPF, DKIM, and DMARC records using an email security checker.
In this guide, you will learn what these records do, how to check them, and what to do if your domain has configuration problems.
What Is an Email Security Checker?
An email security checker is a tool that examines a domain’s email-related configuration and identifies potential security issues.
Depending on its features, it may check DNS records, mail server configuration, sender authentication, and other indicators of email security.
For businesses, these checks are useful because a domain with missing or incorrectly configured authentication records may be more vulnerable to impersonation. However, DNS checks alone cannot detect every phishing attack, compromised account, or malicious email.
Why Are SPF, DKIM, and DMARC Important?
SPF, DKIM, and DMARC are three important email authentication standards. They work together to help receiving email servers verify messages and handle suspicious senders.
1. SPF (Sender Policy Framework)
SPF specifies which mail servers are authorized to send email for your domain.
For example, if your business sends email through Google Workspace, Microsoft 365, or a hosting provider, your SPF record should authorize the appropriate sending infrastructure.
An SPF record is published as a DNS TXT record and commonly begins with v=spf1.
What to check:
- Is an SPF record present?
- Does it authorize your legitimate email service providers?
- Are there conflicting or multiple SPF records?
- Does the record end with an appropriate policy, such as
~allor-all?
A missing or incorrect SPF record can cause authentication failures. Avoid copying another company’s SPF record because the correct configuration depends on your own email services.
2. DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to outgoing emails. Receiving servers can use a public key published in DNS to verify the signature and check whether signed portions of the message have changed.
DKIM records are published under selector-specific DNS names, typically ending in ._domainkey.
What to check:
- Is DKIM configured for your email provider?
- Does the relevant selector publish a valid public key?
- Are outgoing emails actually being signed?
- Does the receiving server report DKIM authentication as passing?
Finding a DKIM record in DNS does not automatically mean your emails are being signed correctly. Your email provider must also be configured to sign messages.
3. DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC builds on SPF and DKIM. It tells receiving servers how to handle messages that fail DMARC authentication and can provide reports about email activity involving your domain.
A DMARC record is published as a TXT record at _dmarc.yourdomain.com. Its policy is defined by the p tag.
The three main policies are:
p=none— Monitor authentication results without requesting quarantine or rejection under the DMARC policy.p=quarantine— Ask receiving servers to treat messages that fail DMARC as suspicious, often by placing them in spam.p=reject— Ask receiving servers to reject messages that fail DMARC.
A p=none policy can be a useful starting point for monitoring. Moving to quarantine or reject provides stronger protection against domain spoofing, but you should first identify and authenticate all legitimate sending services to avoid disrupting genuine business emails.
How to Check SPF, DKIM, and DMARC
Follow these steps to review your domain’s email authentication.
Step 1: Choose your domain.
For example, use example.com if that is your business domain. You do not need to enter a personal email password to perform a public DNS check.
Step 2: Check the SPF record.
Use a DNS lookup tool to inspect the domain’s TXT records. Look for a record beginning with v=spf1. Confirm that it includes your legitimate sending services and does not contain conflicting SPF records.
Step 3: Check DKIM.
Identify the DKIM selector used by your email provider. Then look up the corresponding DNS record, such as selector._domainkey.example.com. Because selectors vary by provider, a general DNS lookup may not discover every active DKIM configuration automatically.
Step 4: Check DMARC.
Look up the TXT record at _dmarc.example.com. Confirm that it begins with v=DMARC1 and review the policy specified by p. If reporting is enabled, also verify that the reporting addresses are valid and able to receive reports.
Step 5: Review the results and fix issues.
A missing record, incorrect DNS value, or failed authentication result deserves investigation. Make changes through your DNS provider or email service administrator, and test again after the changes have propagated.
Common Email Security Problems to Look For
When checking your domain, pay particular attention to these issues:
- Missing SPF: Your domain has no SPF record authorizing its email senders.
- Weak or incorrect SPF configuration: Legitimate services may not be authorized, or the record may contain errors.
- DKIM failures: The selector, public key, or email signing configuration may be incorrect.
- Missing DMARC: Your domain lacks a DMARC policy to guide receivers on handling messages that fail authentication.
- An overly permissive DMARC policy: A monitoring-only policy does not request quarantine or rejection of failing messages.
Remember that passing SPF, DKIM, and DMARC does not guarantee that every email is safe or that your messages will always reach the inbox. These checks are important parts of a broader email security strategy that should also include multifactor authentication, phishing protection, secure account access, and employee awareness.
Check Your Domain with DNS Intelligence
Want to understand your domain’s email security posture?
The DNS Intelligence Email Security Auditor helps you review important email configuration indicators, including MX, SPF, DKIM, and DMARC. It can help you identify potential weaknesses and understand which areas may need further investigation.
Use the DNS Intelligence Email Security Auditor to get started. Enter your domain, review the findings, and use the results to guide your next steps.
If you discover configuration issues, work with your email provider or DNS administrator to correct them and verify the results again.
Final Thoughts
Checking SPF, DKIM, and DMARC is a practical first step toward improving business email security. SPF identifies authorized sending servers, DKIM helps verify signed messages, and DMARC provides a policy for handling authentication failures.
Regularly reviewing these records helps businesses identify configuration problems before they become larger operational or security concerns. Combine email authentication with secure accounts, phishing awareness, and appropriate email protection tools to build a stronger defense.
Start by checking your domain today. A clear understanding of your email configuration makes it easier to identify weaknesses and take informed action.