DMARC, SPF & DKIM Email Security Inspector
Audit your domain against Google, Yahoo, and Microsoft anti-spoofing mandates. Inspect live DNS TXT records, detect policy misconfigurations and permissive SPF flags, and generate production ready DMARC configurations.
1. DMARC Policy
CheckingLoading...
2. SPF Record
CheckingLoading...
3. DKIM Public Key
Selector RequiredEnter selector above to verify DKIM key
Authentication Findings & Recommendations
- Awaiting inspection results...
Hardened DMARC & SPF Policy Generator
Generate RFC compliant, high security DNS TXT records tailored for your domain to eliminate spoofing and satisfy Google/Yahoo delivery requirements.
Frequently Asked Questions
Why are DMARC, SPF, and DKIM mandatory for domain senders in 2026?
Major mailbox providers like Google, Yahoo, and Microsoft enforce strict DMARC, SPF, and DKIM authentication for all domain senders. Domains sending bulk or transactional mail without proper alignment face immediate bouncebacks or spam folder placement.
What is the critical difference between p=none, p=quarantine, and p=reject?
The p=none tag is passive monitoring and does not block spoofed emails from reaching inboxes. The p=quarantine tag routes unauthorized mail to the spam folder. The p=reject tag blocks fraudulent mail outright at the recipient mail server boundary.
What is the 10 DNS lookup limit in SPF records?
RFC 7208 mandates that evaluating an SPF record cannot require more than 10 nested DNS lookups (e.g. include, a, mx, ptr, and redirect mechanisms). Exceeding 10 lookups triggers an SPF PermError, causing authentication to fail.
What is BIMI and how does it relate to DMARC enforcement?
Brand Indicators for Message Identification (BIMI) allows authenticated brands to display official logos next to emails in client inboxes. To qualify for BIMI, a domain must enforce DMARC with either p=quarantine (pct=100) or p=reject.