Free tool · No sign-up
SPF, DKIM & DMARC Checker
Check whether a domain publishes the three records that stop anyone sending mail as you: SPF, DMARC, and a DKIM selector. Reads each record back over DNS-over-HTTPS, explains what its policy actually enforces — an SPF that ends in ~all is not the same as one ending in -all — and tells you what is missing.
Method & assumptions
- SPF lists who may send for the domain; the qualifier on its terminal all decides what happens to everyone else — -all rejects, ~all soft-fails, ?all is neutral, +all passes anyone.
- DMARC ties SPF and DKIM to the visible From address and sets a policy: p=none only monitors and is spoofable in practice, while quarantine and reject are enforced.
- DKIM is checked by probing a handful of common selectors. A domain can use a selector we do not guess, so a blank DKIM result is not proof it is missing.
- Only published DNS records are read — this does not send a test message or verify signing keys actually work.
- This tool sends the domain you enter to Cloudflare's public resolver to read its records. Nothing is sent to JCIT, and the analysis runs entirely in your browser.
Plate —Other tools
More on the bench
- 01DNS LookupEvery record for a domain, from your browser.
- 02SSL Certificate CheckerExpiry, chain, and issuer at a glance.
- 03Supabase Security AuditorPoint it at your project, find the holes.
- 04JWT DecoderPaste a token, read what is inside.
- 05Secret & .env ScannerPaste code or a .env, catch the leaked keys.
- 06Security Headers ScannerEnter a URL, grade its headers.
- 07CORS TesterSee exactly what a URL allows cross-origin.
- 08Base64 Encode / DecodeText or files, both directions.
Free diagnosticsSame-day dispatchNamed techniciansDone or free
Need it built, not just checkedWe write the software
We write the software
behind tools like these
Anyone whose domain sends email and wants to know it cannot be spoofed by a stranger.