SPF, DKIM and DMARC Checker: Email Authentication
Check SPF, DKIM, DMARC, MTA-STS and BIMI for a domain.
Use via API
SPF (with the DNS lookup count), DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI for a domain, with a plain-English verdict. Send JSON, get JSON back; this one reaches the network from PithLab’s server.
POST https://pithlab.com/api/v1/tools/email-auth-checker
curl https://pithlab.com/api/v1/tools/email-auth-checker \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"domain":"example.com"}'About the Email Authentication Checker
Check a domain's SPF, DKIM, DMARC, MX, MTA-STS and BIMI records in one go, with the SPF lookup count, policy problems and a plain-English verdict on spoofing risk.
How to use the Email Authentication Checker
- Enter the domain you send email from, such as example.com. An email address works too.
- Optionally add your DKIM selectors (the s= value in a message's DKIM-Signature header). Common ones are checked by default.
- Press Check. PithLab's server looks up each record through public DNS resolvers and follows SPF includes to count DNS lookups.
- Read the verdict and fix anything marked as a problem first.
Examples
Input
v=DMARC1; p=none; rua=mailto:[email protected]
Output
p=none only monitors: spoofed mail is still delivered. Move to quarantine, then reject, once reports look clean.
Frequently asked questions
What's the SPF 10-lookup limit?
Receivers stop evaluating SPF after 10 DNS lookups (include, a, mx, ptr, exists and redirect each count, including inside included records). Over the limit, SPF fails with a permanent error and your mail can be rejected. The checker follows every include and counts them for you.
Why is p=none flagged?
p=none tells receivers to deliver mail that fails DMARC anyway. It's the right first step while you read the reports, but it doesn't stop spoofing. Move to p=quarantine and then p=reject once legitimate senders all pass.
Why doesn't it find my DKIM key?
DKIM keys live at a selector you can't discover from DNS alone. Open an email you sent, find the DKIM-Signature header and copy its s= value into the selectors box.
Do I need MTA-STS and BIMI?
They're optional. MTA-STS makes other servers deliver to you only over verified TLS, and BIMI shows your logo in supporting inboxes once DMARC is enforced. SPF, DKIM and DMARC matter most.