Free tool
Is your email actually authenticated?
Enter a domain. This checks its SPF, DKIM and DMARC records live and tells you what each one means. Nothing is stored, no signup, no email required.
What these three records do
SPF lists which servers are allowed to send mail using your domain. Without it, anyone can put your domain in the From line and receiving servers have no way to object.
DKIM signs each message cryptographically. It is the one that survives forwarding — SPF breaks the moment a receptionist forwards your email to a partner, and DKIM does not.
DMARC tells receiving servers what to do when SPF and DKIM disagree with the From address, and asks them to send you reports. Start at p=none, read the reports, then tighten.
DKIM is checked by trying the selectors providers actually use (google, selector1, selector2, k1, s1, default, dkim, mail, resend). A domain can hold a valid DKIM key under a custom selector this tool does not guess — so "not found" means "not found at the common names", not "definitely absent". Everything else is read straight from public DNS.
If something above is failing
Missing authentication is usually not the reason nobody replies — but it is the reason some people never see the message at all. We fix send paths as part of a growth audit, and we will tell you plainly if yours is already fine.
Book a call →