Domain checker
Every record that decides whether your email is trusted — DMARC, SPF, DKIM, MX, MTA-STS and ten more — read in one pass from public DNS. No account. We keep no per-visitor record of what you check beyond standard server logs, kept 90 days.
At p=none, the reports name every sender. The policy simulator on Protect models quarantine and reject against them before you publish — 14-day trial.
The panel above is a worked example on three made-up domains, showing the five records that decide most outcomes. Running a real domain resolves all 14 checks against live DNS. Public records only — nothing is stored, result pages are not indexed, and checking a domain reveals nothing its owner has not already published.
14 checks, five that decide most outcomes.
Each one answers a different question, and each has a way of looking fine while doing nothing. The right-hand column is the failure the check exists to catch.
Passes when: A record exists and p= is quarantine or reject, with an rua address collecting reports.
p=none is the most common state on the internet and blocks nothing. It reads as “DMARC configured” on every dashboard while forged mail keeps landing in inboxes.
Passes when: One record, ending in -all, resolving inside the ten-DNS-lookup limit.
Cross the lookup limit and the record does not degrade — it fails permanently, and receivers treat you as having no SPF at all. Adding one more include is how it usually happens.
Passes when: At least one selector returns a valid key of 1024 bits or more.
Selectors cannot be enumerated from DNS, so we probe six common names. A blank result means we could not find one, not that signing is off — a custom selector is invisible from outside.
Passes when: At least one host published, resolving, and answering on port 25.
MX says nothing about who may send as you — a perfect MX record next to a missing DMARC record is the exact shape of a spoofable domain.
Passes when: The TXT record resolves and the policy file is served over HTTPS in enforce mode, listing your real MX hosts.
The DNS half without the HTTPS half does nothing at all. Publishing the record and never serving the policy is the single most common MTA-STS mistake.
A read tells you what is published, not what is happening.
Three tools that go deeper on one record.
Every tag in your policy explained, including the ones you did not write and the defaults they fall back to.
Check a specific selector by name — the one this page cannot guess — and read its key type and size.
Fetches the record and links the policy file, which is where the two halves usually come apart.
One check is a photograph.
Records drift — a migration drops a tag, a provider rotates the IPs behind their SPF include, a key expires. On any paid plan DDMARC re-checks every record on a schedule and tells you the same day; on every plan it names every service sending as you.
Frequently asked questions.
The domain checker runs 14 checks in one pass across DNS and TLS records, and grades the five that decide most outcomes: DMARC, SPF, DKIM, MX, and MTA-STS.
No. No DDMARC tool or plan checks domains against email blocklists. The checker reads DNS records and, for MTA-STS, the published policy file.
No per-visitor record of the domains you check is kept beyond standard server logs. Every check reads the records fresh from public DNS.
No. A single check only reads what is published in DNS. Identifying which services send mail as your domain needs DMARC aggregate reports collected over days, which a monitoring plan such as Monitor, free for 2 domains, gathers automatically.
For the full walkthrough, see the DMARC setup guide.
DMARC Report Analyzer
Paste or upload a DMARC aggregate (RUA) report and see total volume, pass/fail rates, and which senders are failing. Runs in your browser.
DMARC Record Generator
Create a valid DMARC record for your domain. Configure policy, reporting emails, and advanced options.
SPF Record Generator
Build an SPF record to authorize your email senders. Includes common services and DNS lookup counter.
DKIM Key and Record Generator
Generate a DKIM key pair in your browser and get the TXT record to publish. The private key never leaves your device.
MTA-STS Record and Policy Generator
Build the _mta-sts TXT record and the mta-sts.txt policy file together, with MX patterns and max_age checked.
TLS-RPT Record Generator
Build the _smtp._tls record that asks senders to report failed TLS connections, with email and https destinations checked.
SPF Checker
Look up a domain's SPF record, walk every include, and count DNS lookups against the limit of 10.
DMARC Checker
Look up any domain's DMARC record and get every tag explained — policy, alignment, reporting, and coverage.
DKIM Checker
Check a domain's DKIM record by selector. See the key type, size, and each tag, with quick-picks for common providers.
MTA-STS & TLS-RPT Checker
Check a domain's MTA-STS policy record and TLS-RPT reporting — the pair that forces inbound mail over TLS.
BIMI Checker
Look up a domain's BIMI record, preview the logo, and confirm the VMC and DMARC enforcement it requires.