Domain DNS check (SPF, DMARC, DKIM)
Enter a domain to see its DNS records and e-mail configuration: A, AAAA, MX, NS, TXT, SPF, DMARC and DKIM. The tool evaluates whether the domain is protected against sender spoofing. Queries go straight from your browser to Cloudflare's public resolver (DNS over HTTPS) – the domain name is the only thing that leaves your browser.
FAQ
What are SPF, DKIM and DMARC?
Three e-mail authentication standards. SPF (a TXT record) lists the servers allowed to send mail for the domain. DKIM signs messages cryptographically; the public key lives in DNS under a selector. DMARC tells receivers what to do with messages that fail SPF and DKIM and where to send reports.
What is a DKIM selector?
The name under which the public key is stored in DNS (selector._domainkey.domain). It depends on the provider: Google uses “google”, Microsoft 365 “selector1/2”, others “default”, “k1”, etc. The tool tries common selectors; you can enter your own.
Why does the result differ from my provider's?
DNS changes propagate gradually (TTL up to tens of hours). The query goes to Cloudflare's 1.1.1.1 resolver, which may have the record cached.
What leaves my browser?
Only the domain name, sent to Cloudflare's public DNS resolver over encrypted DNS over HTTPS – just like when you open any website. No other data is sent.