Request pricingGet started
  1. Home
  2. Developers
  3. SPF, DKIM and DMARC checker
Free tool · live DNS lookup

SPF, DKIM and DMARC checker

Enter a domain to check its SPF record, its DMARC policy and the tinyRelay DKIM record. The lookup runs in your browser against public DNS, and nothing is stored.

What each check means ↓Validate DNS docs ↗
PUBLIC DNS

Looks up TXT at the domain, TXT at _dmarc, and CNAME at tec1._domainkey. Example:

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
SPF TXT · domainNot checked
DKIM CNAME · tec1Not checked
DMARC TXT · _dmarcNot checked

SPF: one TXT record at the domain, starting v=spf1.

What each check means

SPF checker, DKIM checker, DMARC checker: three lookups.

Each check reads one public DNS record and tells you what it found. Here is what each record does and how to read the result.

SPF

TXT · domain

Sender Policy Framework lists the servers allowed to send mail for your domain, in one TXT record starting with v=spf1.

  • Found: one SPF record
  • Multiple: merge them; a domain must publish only one
  • Missing: publish one listing every service that sends for you

DKIM

CNAME · tec1

DomainKeys Identified Mail signs each message. Receivers fetch the public key from a selector under _domainkey on your domain.

  • Set up: tec1 points to tec1.dkim.tinyemail.com
  • Other target: the CNAME points somewhere else
  • Not set: only needed if you send through tinyRelay

DMARC

TXT · _dmarc

DMARC tells receivers what to do with mail that fails SPF and DKIM alignment, in a TXT record at _dmarc starting with v=DMARC1.

  • none: monitoring only
  • quarantine: treat failing mail as suspicious
  • reject: refuse failing mail

The full walkthrough is in SPF, DKIM and DMARC for transactional senders. Mailbox providers' current rules are summarised in Gmail and Yahoo sender requirements.

tinyRelay's DKIM selector

One CNAME, and an endpoint that checks it.

tinyRelay signs your mail with the selector tec1. You add one CNAME on each sending domain, pointing at tinyRelay's key, and share your sender domains with our team so they can be added to our mail servers.

The record you add
HOST  tec1._domainkey.yourdomain.com
TYPE  CNAME
VALUE tec1.dkim.tinyemail.com

Because it is a CNAME, the key stays on our side. A receiver that looks up tec1._domainkey on your domain is pointed to it.

Validate DKIM and SPF in the docs →
PUT /domain/dns/check · example response from the docsCopy
// request body: { "domain": "yourdomain.com" }
{
  "dkim": {
    "status": "Invalid",
    "dns": [
      { "type": "CNAME", "name": "tec1._domainkey.", "value": "tec1.dkim.tinyemail.com" }
    ]
  },
  "spf": {
    "status": "Valid",
    "dns": [
      { "type": "TXT", "name": "@",
        "value": "\"v=spf1 include:_spf.google.com include:_spf.tinyemail.com include:spf.autopilothq.com include:one.zoho.com -all\"" }
    ]
  }
}

The docs' example: DKIM not yet set up, SPF valid. The endpoint returns the records it expects for your domain.

Good to know

What this checker does, and does not do.

Reads public DNS over HTTPS (Cloudflare, falling back to Google)Yes
Stores the domains you checkNo
Checks DKIM selectors other than tec1No
Shows changes before DNS caches expireNot always

Seeing BOUNCED events with category 55? That means a receiver refused mail on SPF, DKIM or DMARC policy. See bounce code 55 and transactional email deliverability.

FAQ

Checker questions.

Sources
RFC 7208, Sender Policy Framework: rfc-editor.org/rfc/rfc7208
RFC 6376, DKIM Signatures: rfc-editor.org/rfc/rfc6376
RFC 7489, DMARC: rfc-editor.org/rfc/rfc7489
Is the checker free?

Yes. It runs in your browser with no sign-up. It reads public DNS records only, and nothing you enter is stored.

The checker looks only for tinyRelay's DKIM record, a CNAME at tec1._domainkey on your domain. Other providers use other selectors, which this tool does not look up. You only need the tinyRelay record if you send through tinyRelay.

No. RFC 7208 says a domain must not publish multiple SPF records. If the checker finds more than one, merge them into a single record that lists every service that sends for the domain.

p=none asks receivers to take no specific action on mail that fails, so it is a monitoring setting. Quarantine and reject ask receivers to treat failing mail more strictly.

Yes. PUT /domain/dns/check validates DKIM and SPF for a domain and returns a Valid or Invalid status with the DNS records it expects.

Get started

Send transactional email with a service that reports back.

SMTP relay or REST API, standalone or alongside tinyEmail. Tell us what you send and our team sets you up.

Get startedRequest pricing