Email security checker: SPF, DKIM, DMARC and header analyzer

What you can do with Email Security Checker

• Security grade from A to F, with a shareable link to the result.
• SPF include tree with the real lookup count (limit 10), void lookups (limit 2), missing or duplicate includes, and includes that end in +all.
• DMARC graded against RFC 9989, published in May 2026: obsolete pct, rf and ri tags, the new t (test mode) and np (non-existent subdomain) tags, and policy inherited from a parent domain.
• Corrected records: merged or repaired SPF, a flattened SPF when you exceed 10 lookups, and a dated, staged DMARC plan from none to quarantine to reject.
• Email header analyzer: SPF, DKIM and DMARC results with alignment, the delivery path with delays, one-click unsubscribe and Microsoft spam score.
• Detection of the email services a domain uses, such as Microsoft 365, Google Workspace, SendGrid or Mailchimp, with a warning when one has no DKIM key.
• DKIM key discovery, MX, MTA-STS, TLS-RPT, BIMI and DNSSEC checks, plus a DMARC record generator using the 2026 tag set.

How to use it

1. Enter your domain and select Check domain.
2. Start with the items marked Fail, then copy the corrected records from Suggested fixes into your DNS.
3. If a message went to spam, paste its headers into the Header analyzer to see which check failed.
4. Publish DMARC with p=none and a reporting address, then follow the dated plan to quarantine and reject.
5. Re-run the check after each DNS change, and share the result link with your team or provider.

What changed in DMARC in 2026

In May 2026 the IETF published RFC 9989, 9990 and 9991, replacing the 2015 DMARC specification. Records still start with v=DMARC1 and keep working. The pct, rf and ri tags were removed. The new t=y tag marks test mode, where updated receivers apply your policy one level softer, and np sets a policy for subdomains that do not exist. Older receivers ignore t, so a staged rollout from none to quarantine to reject is still the safe path.

Why SPF breaks at 10 lookups

Every include, a, mx, exists and redirect term makes the receiving server query DNS, and nested includes count too. RFC 7208 caps the total at 10 and allows at most 2 lookups that return nothing. Exceed either and SPF fails for every message. The include tree shows where each lookup comes from, and the checker suggests a flattened record when you are over the limit.

Limitations

DKIM keys can only be found at selectors that are tested; the header analyzer reveals your real selector. Results reflect public DNS at the moment of the check. Live SMTP and TLS connection tests are not performed.

Frequently asked questions

Do I need to change my DMARC record for RFC 9989?

Existing v=DMARC1 records keep working. Remove the obsolete pct, rf and ri tags, use t=y instead of pct for testing, and consider adding np=reject. The checker produces the updated record for you.

What does the SPF 10-lookup limit mean?

Receivers stop evaluating SPF after 10 DNS-querying terms, including nested includes. Exceeding it causes a permanent SPF error, so the message fails SPF.

Why did my email go to spam even though SPF passed?

DMARC needs SPF or DKIM to pass and be aligned with the From domain. Mail sent through a service often passes SPF for the service's own domain, which is not aligned. Paste the headers into the analyzer to see which check is aligned.

How do I find my DKIM selector?

Paste the headers of a message you sent into the Header analyzer. It reads the selector from the DKIM signature and can run the domain check with it.

Is my data sent to Toolveriq?

No. DNS queries go from your browser to Cloudflare's public DNS-over-HTTPS service, and pasted headers never leave your browser.