Free email authentication check
See what your domain's public DNS says about SPF, DKIM and DMARC: the records we found, what is a risk, what DNS alone cannot tell, and what to change for the mail providers you use.
What this check does — and does not do
- It reads public DNS records only (MX, SPF, DKIM under known selectors, DMARC, MTA-STS, TLS-RPT). It never changes DNS and never asks for mailbox access.
- It cannot prove that your mail reaches the inbox. Inbox placement also depends on content, list quality and sender reputation; authentication is necessary, not sufficient.
- DMARC
p=noneis a legitimate monitoring stage, not an error in itself. - DKIM selectors cannot be listed from DNS. If no key is found under the selectors we probe, that is reported as unknown, not as proof that DKIM is missing.
Privacy
The domain you enter is looked up in public DNS through the recursive resolvers of our hosting provider, Hetzner (Germany); no other DNS service is used. Domain and result are kept in memory for up to 10 minutes and never written to disk or logs; your IP address is not passed to the check. To limit abuse, a one-way hash of your IP address (keyed with a secret and the date, so it changes daily) is held in memory and deleted within 25 hours after your last check. We count only how many checks are run per day. Details: privacy policy, section 8.
This tool is part of the public 28/28 experiment by Arts Ventures, operated by VIRTUOSITY LLC. It is the candidate for venture 01; whether anyone needs it is exactly what the experiment tests.