How to check SPF, DKIM and DMARC
Enter a domain or a full email address and, if you have it, a DKIM selector. Press Check records. We look up the domain's SPF TXT record, _dmarc, common DKIM selectors, BIMI, MTA-STS and TLS-RPT through DNS, then grade what is published. For the mail servers themselves, open the MX lookup. To see who hosts the mailbox, use the email host lookup.
Worked examples
These links run the same lookup and are safe to share:
gmail.com— Google publishes SPF, DKIM and DMARC for consumer Gmail.outlook.com— Microsoft's consumer Outlook.com records.proton.me— Proton Mail's published authentication records.
The letter grade is about the records as they appear in DNS that day, not a promise about inbox placement. To read the SPF, DKIM and DMARC results stored on a specific message, paste its headers into the email header analyzer.
Reading the grade
A or B usually means SPF is restrictive, at least one DKIM key was found, and DMARC is quarantine or reject. C often means the pieces exist but DMARC is still monitor-only (p=none). D or F means records are missing, contradictory (more than one SPF record) or end with +all, which allows any server to send. If you only needed a disposable address to test a form, open a temp inbox and, if the address looks off, the email address validator.
Questions
What do SPF, DKIM and DMARC actually check?
SPF lists servers allowed to send for a domain. DKIM publishes a public key so receivers can verify a signature. DMARC tells receivers what to do if those checks fail for the visible From domain, and can request reports. This tool reads the published records; it does not re-sign or resend a message.
Why do I need a DKIM selector?
DKIM keys live at selector._domainkey.example.com. If you know the selector (often printed in a message's DKIM-Signature header as s=), enter it. If you leave it blank we try a short list of common selectors such as google and selector1. A miss does not prove the domain has no key.
What are BIMI and MTA-STS?
BIMI is a way to publish a logo that some inboxes may show when DMARC is strict enough. MTA-STS lets a domain require TLS for inbound mail and publish a policy file. TLS-RPT, when present, asks for reports about TLS failures. All three are optional extras on top of SPF, DKIM and DMARC.
Is the domain I look up sent to Volt Ghost?
Yes. The domain (the part after @, never the inbox name) is sent so we can query DNS and grade the records. Provider-style parsing stays on our side. We do not log that query. We keep short abuse logs to enforce rate limits.