How to Check SPF, DKIM, and DMARC Records

How to Check SPF, DKIM, and DMARC Records for Any Domain

When you need to audit a domain's email authentication setup - for a new client, a deliverability problem, or a security review - you need to know how to check SPF, DKIM, and DMARC records quickly and correctly. Here is the practical way to do it.

You can check all three records using free command-line tools or online checkers. The method you choose depends on whether you need a one-off lookup or ongoing monitoring.

How to Check the SPF Record

SPF (Sender Policy Framework) publishes which mail servers are allowed to send email for a domain. To check it:

Using dig:

dig TXT example.com

Look for the TXT record that starts with v=spf1. That is the SPF record.

What to look for:

v=spf1 - the SPF version identifier

include:spf.example.com - authorizes another domain's servers

ip4:192.0.2.1 - authorizes a specific IP address

~all - softfail (unauthorized servers are flagged but not rejected)

-all - reject (unauthorized servers are rejected)

+all - allow any server (a serious misconfiguration)

A properly configured SPF record limits which servers can send mail for your domain. If you see +all, that is an open door - anyone can spoof your domain from any server.

How to Check the DKIM Record

DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing email. The public key is published as a DNS TXT record.

DKIM requires knowing the selector name. Selectors are set by the email provider when DKIM is configured, and different providers use different names. Common ones include selector1, selector2, dkim, and default. The selector should be documented in your email provider's DKIM setup instructions.

Using dig:

dig TXT selector._domainkey.example.com

Replace selector with the actual selector name and example.com with the domain.

If you do not know the selector, check the email header of a message sent from the domain. Look for the DKIM-Signature header. It will contain a d= tag (the signing domain) and an s= tag (the selector):


DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1;

In this case, selector1 is the selector you query:

dig TXT selector1._domainkey.example.com

What to look for:

v=DKIM1 - the DKIM version

k=rsa - the key type (RSA is standard)

p= - the public key itself

A DKIM record with a valid p= value means the domain is signing outbound mail with that selector. A record with p= set to empty ("no public key") means that selector has been revoked.

How to Check the DMARC Record

DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM with a policy that tells receivers what to do with emails that fail authentication.

To check the DMARC record:

Using dig:

dig TXT _dmarc.example.com

The DMARC record lives at _dmarc.example.com as a DNS TXT record.

What to look for:

v=DMARC1 - the DMARC version

p= none | quarantine | reject - the policy (monitor, flag, or reject)

rua=mailto:reports@example.com - where to send aggregate reports

ruf=mailto:reports@example.com - where to send forensic reports

pct=100 - percentage of mail subject to DMARC policy

sp= - policy for subdomains

adkim=s / aspf=r - alignment mode (strict or relaxed)

The p tag is the most important. p=none means the domain is monitoring but not enforcing. p=quarantine means suspicious mail gets flagged. p=reject means unauthorized mail is blocked.

Quick Online Checkers

If you prefer not to use the command line, these free tools do all three lookups in one step:

MXToolbox SuperTool (mxtoolbox.com/SuperTool.aspx) - enter a domain, run SPF lookup, DKIM lookup, and DMARC lookup individually or use the all-in-one command
Google Admin Toolbox (toolbox.googleapps.com) - dig-based lookup for SPF and DMARC
DMARC Playground (dmarcplayground.com) - specifically designed for DMARC record validation

These tools are useful for one-off checks. They do not give you ongoing visibility.

Why Authentication Passing Does Not Mean Alignment Passing

A common point of confusion: SPF, DKIM, and DMARC are checked separately, and they can all pass individually while DMARC still fails.

DMARC requires two things:
1. At least one authentication mechanism (SPF or DKIM) passes
2. That passing mechanism aligns with the sender domain

Alignment means the domain in the From: header matches the domain used for SPF or DKIM. A message can pass SPF and DKIM but still fail DMARC if the sending server's envelope domain does not match the From: header domain.

For example: you use a marketing email platform to send newsletters. The platform's SPF passes because you are authorized to send through it. But if the platform signs with its own domain (not yours), DKIM passes but does not align - and DMARC fails.

This is why checking SPF and DKIM separately is not enough. You need to check alignment, which requires looking at the actual email headers or the DMARC aggregate report.

How to Check DMARC Alignment in Email Headers

If you have access to a raw email, look at the Authentication-Results header. This header is added by the receiving mail server and shows:


Authentication-Results: mx.example.com;
  dkim=pass header.d=example.com;
  spf=pass smtp.mailfrom=example.com;
  dmarc=pass header.from=example.com

The dmarc=pass line means both authentication and alignment passed. If it shows dmarc=fail, the Authentication-Results header will usually indicate whether SPF alignment, DKIM alignment, or both failed.

What Your DMARC Report Actually Tells You

If the domain has a DMARC rua reporting address, you can request an aggregate report. These reports tell you:

Which IPs are sending mail for the domain
How many emails passed SPF, DKIM, or both
How many failed and why

Reading DMARC reports is a skill on its own. The reports arrive as XML files attached to emails, and there are free tools to parse them. If you are managing multiple domains, the volume of reports can become unmanageable without automation.

How to Check All Three Records for a Client Domain

Here is the practical checklist for auditing a client domain:

1. Query the SPF record: dig TXT clientdomain.com
2. Find the DKIM selector from an email header and query it: dig TXT selector._domainkey.clientdomain.com
3. Query the DMARC record: dig TXT _dmarc.clientdomain.com
4. Ask the client for a sample DMARC aggregate report if they have rua configured
5. If possible, examine a raw email header from the client to check alignment results

This gives you the full picture of where the domain stands. Most problems show up in the DMARC record: either p=none (no enforcement), missing rua (no reporting), or alignment issues in the email headers.

One-Off Checks vs Ongoing Monitoring

The methods above are useful for a point-in-time audit. But one-off checks have a gap: they tell you what the state is right now, not when something changes or breaks.

Consider this scenario. You audit a client's domain today - SPF looks correct, DKIM is signing, DMARC is set to reject. Six months later, the email platform changes its DKIM selector but does not notify you. Your one-off check would have shown everything passing, but in the intervening months, the new selector was never configured and all outbound mail failed DKIM alignment. Your client only notices when deliverability drops.

Ongoing monitoring catches this. DMARCFlow watches SPF, DKIM, and DMARC records for your managed domains and alerts you when something changes. For consultants managing multiple client domains, this is the difference between finding out about an authentication problem from a client complaint versus catching it proactively.

For a one-off audit, use the command-line checks above. For continuous coverage across your client portfolio, use DMARCFlow.

FAQ

How do I check SPF, DKIM, and DMARC for free?
Use dig from the command line or MXToolbox's free online SuperTool. Both give you all three records without cost.

What is the difference between SPF and DKIM?
SPF authorizes which mail servers can send mail for your domain. DKIM adds a cryptographic signature that verifies the email was not modified in transit and proves it came from your domain. They check different things and both feed into DMARC.

Can SPF pass but DMARC still fail?
Yes. DMARC requires both authentication (SPF or DKIM passes) and alignment (the From: header domain matches the authenticated domain). SPF can pass for the envelope domain while DMARC fails because the From: header domain does not align.

What does p=none mean in a DMARC record?
p=none is a monitoring policy. The domain is collecting DMARC reports but not taking action on emails that fail authentication. It is the first step before moving to p=quarantine or p=reject.

How do I read a DMARC aggregate report?
DMARC aggregate reports arrive as XML attachments. Tools like dmarcian.com, MXToolbox, and DMARCPlayground can parse them into readable summaries. Look for the source_ip counts, dkim_align and spf_align results, and the disposition field.

What is the quickest way to check all three records at once?
MXToolbox SuperTool lets you run SPF, DKIM, and DMARC lookups for a domain from one interface. For a more complete picture including alignment, request a DMARC aggregate report from the domain owner.