Email Authentication Checker

Free tool by AAJ - can someone send email that claims to be from you?

Anyone can put your domain in the From line of an email. Whether receivers believe it comes down to three DNS records: SPF, DKIM and DMARC. This checker reads the live records for any domain, straight from public DNS in your browser, and tells you whether the domain can be spoofed, what each record says, and the exact record that fixes each gap.

Use the tool at aajconsult.com/tools/email-authentication-checker.

What it checks

SPF: that there is exactly one record, that it ends in a policy for unlisted servers (~all or -all, never +all), that it avoids the deprecated ptr mechanism, and that the whole include chain stays within the ten DNS lookups the SPF standard allows. The checker walks every nested include to count them, and flags includes that point at a domain with no SPF record, because either problem turns SPF into a permanent error for all of your mail.

DKIM: whether a signing key is published under the selectors common email providers use, plus any selector you enter. For each key it reports the type and approximate RSA key size, and whether the key has been revoked.

DMARC: whether a record exists at _dmarc (or is inherited from a parent domain), the policy (none, quarantine or reject), whether the policy applies to all failing mail or only a percentage of it, and whether aggregate reports are going anywhere. It also notes MX, MTA-STS, TLS reporting and BIMI, which are optional.

A verdict, not a score

Email authentication works like a lock. A perfect SPF record with a DMARC policy of none still lets spoofed mail through, while a policy of reject on top of one working signature stops it. Averaging those into a number would hide the one thing that matters, so the checker gives one of three verdicts: Protected, Partly protected, or Anyone can send as this domain. Every finding behind the verdict shows the record text it was read from.

Why DKIM can come back as not found

A DKIM key lives under a selector name chosen by your email provider, and DNS has no way to list them. The checker tries the common ones, and if yours is different it says so plainly rather than reporting a failure: a missing key can never be proven from outside. To find your selector, open an email you sent, view the original message, and read the s= value in the DKIM-Signature header.

What the inbox providers require

Gmail's email sender guidelines require every sender to set up SPF or DKIM, and high-volume senders to have both plus a DMARC record, with the From domain aligned to one of them. A DMARC policy of none meets that rule. It does not stop anyone impersonating you, which is why the verdict here asks for more.

Frequently asked questions

We don't send email from this domain. Does it matter?

Yes. Unused domains are easy to spoof because nobody watches them. Publish SPF v=spf1 -all and DMARC v=DMARC1; p=reject so receivers refuse anything claiming to come from it.

Is my domain stored or shared?

AAJ never receives it. Your browser asks Google Public DNS, with Cloudflare DNS as a fallback, for the public records directly. Nothing is saved and there is no signup.

Related resources

Website Conversion Audit - Crawl-to-Citation Scorer - Cold email for founders - Retention & Expansion hub - Ops, AI & Team hub - All free tools

Delivered is not the same as read.

Authentication gets your mail past the gate. Whether anyone opens it comes down to list quality, relevance and what you ask people to do. AAJ works on both. See the Growth Audit.