// TOOLS

Security Tools

🩺 SPF / DMARC / DKIM Auditor

Enter a domain and check live whether it is protected against email spoofing. We query its SPF, DMARC and DKIM over DNS-over-HTTPS, grade them and tell you what fails and how to fix it.

Frequently asked questions

How does it query the records with no backend?
It uses Cloudflare DNS-over-HTTPS from your browser to read the domain's SPF, DMARC and DKIM TXT records. There is no intermediate server: the query goes from your browser to the DNS resolver, and the domain you audit is public information.
Why does it sometimes not detect DKIM?
DKIM is published under a "selector" (selector._domainkey.domain) that cannot be reliably guessed. We probe the most common selectors; if yours is custom, type it in the selectors field so it can be checked.
How is the grade calculated?
Each record is scored separately (the "all" policy in SPF, p/rua/pct in DMARC, key presence and strength in DKIM) and combined weighting DMARC and SPF more, since they are what actually stop spoofing. The grade runs A to F.
What if it finds problems?
Each issue comes with an explanation of how to fix it, plus a link to the SPF/DMARC/DKIM Generator to build the correct record and publish it in your DNS.