This tool runs entirely in your browser. The only network call it makes is a standard DNS-over-HTTPS lookup to Google's public DNS resolver (dns.google) for the domain you enter — the same kind of lookup any DNS tool performs. Nothing is sent to our servers, and there's no analytics or tracking of any kind.
This is read-only. It looks up public DNS records — the same records anyone on the internet can already see — and explains what they mean. It doesn't and can't modify anything. For background on what SPF, DKIM and DMARC actually do, see SPF, DKIM and DMARC explained.
No http:// or www. — just the bare domain.
Ask your mail provider, or check a raw email's headers for d= and s=.
Why DKIM needs a selector
SPF lives at your domain's root and DMARC always lives at a fixed location (_dmarc.yourdomain.com), so both can be found automatically. DKIM is different by design: a domain can publish many DKIM keys at once, each under its own selector — a short name chosen by whoever set it up, forming a record at selector._domainkey.yourdomain.com. There's no master list and no way to enumerate them from outside. Google Workspace commonly uses google, Microsoft 365 rotates through selectors like selector1/selector2, and other providers pick their own. If you don't know yours, check your mail provider's DKIM setup instructions, or look at the DKIM-Signature header of an email you've sent for the s= value.
What "good" looks like
- Exactly one SPF record, with every legitimate sender covered and comfortably under the 10 DNS lookup limit
- A DMARC record with a reporting address set, even at
p=none - DKIM configured and passing for every legitimate mail source, once you know which selectors to check
Found a problem? Use our SPF generator or DMARC generator to build a corrected record.
Build an SPF record →