Check a domain's email security setup by looking up SPF, DKIM, DMARC, and MTA-STS DNS records.
Enter an email domain to inspect the DNS records used for sender authorization, message authentication, domain policy, and transport-security signaling. The checker looks for SPF at the domain, DMARC under _dmarc, DKIM beneath a selector-specific _domainkey name, and MTA-STS under _mta-sts. A common surprise is that DKIM cannot be conclusively checked from a domain alone: every DKIM key is addressed by a selector, usually obtained from a signed message or the mail provider's configuration.
SPF is normally a TXT record at the domain being checked. DMARC uses _dmarc followed by that domain. A DKIM public key uses a name shaped like selector._domainkey.domain, so the selector is part of the lookup. MTA-STS signaling uses a TXT record at _mta-sts.domain. Each mechanism has its own record syntax and purpose.
SPF describes which hosts may send for a domain. DKIM publishes a public key used to verify matching message signatures. DMARC states how receivers should evaluate aligned SPF or DKIM results and may request reports. The MTA-STS TXT record identifies a published policy version, but the transport policy itself is a separate document served from the domain's designated HTTPS location.
No. DNS publication is only part of the setup. Actual messages must use the intended envelope sender and DKIM selector, signatures must verify, and DMARC alignment must succeed. Mailbox compromise, weak account controls, forwarding behavior, reputation, and receiving-server policy are outside what these DNS records alone can establish.
SPF and DMARC have predictable DNS locations, while DKIM does not have one universal record name. Its lookup name includes a selector chosen by the sender. Obtain the selector from the s= value in a message's DKIM-Signature header or from the sending provider's setup instructions, then check that selector for the signing domain.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.