SPF, DKIM & DMARC checker: inspect your email DNS.
Check published email records and create a provider worksheet for Google Workspace or Resend. Browser checks and exports — free, no sign-up.
Loading the tool…
Provider instructions verified 2026-10-09; next review 2026-11-09. DNS syntax inspection only. Generated records require real provider-issued public keys and targets.
How to use
- Enter your email domain and the DKIM selector from your sending provider. Choose Check email DNS.
- Review SPF expansion, DMARC syntax and the selected published DKIM key. Missing records and incomplete checks are shown explicitly.
- To generate records, select a provider and supply its public DKIM key and exact selector. Resend also needs its dashboard CNAME targets. Copy or download the worksheet.
Reference documentation
Frequently asked questions
Is this free, and where does my domain go?
Free, no sign-up. DNS queries go directly from your browser to Cloudflare or Google over HTTPS. Public resolvers receive the queried names and may log them. SaaSCode has no DNS processing server; analytics contain only the tool name and action.
How is the SPF 10-lookup limit checked?
The checker expands includes and redirects recursively and counts DNS-dependent include, a, mx, ptr and exists terms. This is a conservative expanded path, not sender/IP evaluation: earlier matches can stop evaluation. Macro-dependent paths are incomplete; cycles and more than 10 expanded terms are flagged. MX/PTR address limits and void-query recommendations need a sender/IP test. RFC 7208 SPF lookup limits ↗
Does a green check prove my emails pass authentication?
No. These are published-record and syntax checks. The tool does not verify an actual DKIM signature, an SPF sender/IP, DMARC alignment, external reporting authorization or inbox placement. A DKIM key needs provider-issued bytes; this tool never generates a signing key.
Why do I have to provide the DKIM selector?
DKIM keys live at selector._domainkey.domain. DNS does not offer a reliable way to enumerate every selector. Use the selector from your provider dashboard or the s= value in a real DKIM-Signature header. CNAME aliases returned by the resolver are followed to TXT keys.
What DMARC syntax is validated?
One exact-name DMARC record, version and policy ordering, duplicate tags, policy values, alignment modes, percentage, interval, failure options and mailto reporting syntax. Organizational-domain fallback is not evaluated. Unknown extension tags are preserved.
Which Resend records does the generator create?
For dashboards using the current default send/rsend setup, it creates both CNAME records from the exact targets you supply plus your provider-issued TXT RSA DKIM key and a monitoring DMARC record. Resend domains created after August 2026 may use CNAME rather than older TXT/MX SPF records. Follow your dashboard if it shows another configuration. Resend DNS record configurations ↗
Can I publish these alongside my existing SPF?
Do not create a second SPF record at the same name. The Google worksheet assumes Google Workspace is the only sender; merge other authorized senders into the existing record. DMARC p=none starts in monitoring mode. Review your mail streams before quarantine or reject. Google Workspace SPF setup ↗
Related tools
All free toolsBase64 encode / decode
Encode and decode Base64 text and files, create image data URIs and use URL-safe encoding. Recognize JSON and JWTs. Free, no sign-up, browser only.
Markdown editor & table generator
Edit Markdown with a live preview, create tables and start from README.md, AGENTS.md, CLAUDE.md or llms.txt templates. Free, no sign-up, browser only.
Unix timestamp converter
Convert epoch seconds, milliseconds and ISO dates in your browser. Inspect time zones and PostgreSQL timestamptz for Next.js + Supabase. Free, no sign-up.