DMARC, SPF, and DKIM Checker

Check a domain’s email authentication and see what to fix.

This reads the public DNS records that tell mail providers how to treat email using a domain. It can show how those records are set up, but not whether your mail is actually passing. For that you need the DMARC reports. Lookups go from your browser to Cloudflare’s public DNS resolver.

DMARC Monitoring

The checker shows your records. Monitoring shows what’s actually happening.

Mail providers send daily reports on every message that claims to be from your domain. We turn those reports into a dashboard, alerts, and a monthly report, and we do the work to get you to enforcement.

A private dashboard

Every sender using your domain, its pass rate, and where spoofing comes from. You sign in with a one-time code sent to your email, and only your domains are visible to you.

Alerts when something changes

Checked every hour. You hear about a spoofing spike, an approved sender that starts failing, or a new service sending as you.

A monthly PDF report

Sent on the 1st, with plain-English actions at the top, like the sample below.

The setup work

We list your senders, fix SPF and DKIM, and move your policy to quarantine and then reject when the reports show it’s safe.

How it works

You add our reporting address to your DMARC record. It’s a one-line DNS change, and we send you the exact record.
Mail providers send their reports to us, usually starting within 24 to 48 hours.
We approve your known senders and fix any that fail.
You get the dashboard and alerts right away, and your first PDF report on the 1st of the month.

We use it on our own domain, which publishes p=reject with strict alignment. It works with any mail platform, and our setup work goes deepest on Microsoft 365.

Sample Report

What a monthly report looks like.

This is our real report format, filled with made-up data for a fictional company at example.com. The IP addresses come from ranges reserved for documentation.

Email Domain Protection Report
Example Company · example.com

October 2026

Messages reported25,646

Passed DMARC97.1%

Spoofing attempts386

Stopped by receivers671

p=quarantine Partially protected. Spoofed mail goes to junk folders, where people can still open it.

Recommended actions

example.com is at p=quarantine — recommend p=reject
Quarantined spoofs still land in recipients' junk folders, where they get opened. With senders authenticating cleanly, reject is the recommended end state.
Billing system is failing authentication (316 of 412 messages)
This is a sender you use. Fix SPF alignment and DKIM signing so its mail isn't blocked once the policy is enforced.
New authenticated sender: Help desk software (188 messages)
This service is sending as your domain and passing DMARC, but it isn't on your approved list. Confirm it's yours — if not, revoke its access.
31 unauthorized messages were still delivered
Receivers delivered these because the policy wasn't enforcing. Moving to p=reject stops them.

Who is sending as this domain

Source	Messages	DMARC pass	Status
Microsoft 365	18,420	100%	Authenticated
Marketing email platform	6,240	100%	Authenticated
Billing system	412	23%	Approved sender failing
Help desk software	188	100%	Authenticated (unlisted)
Unidentified senders	386	0%	Unauthorized

Download the full sample (PDF)Talk to an engineer

The full sample also covers daily volume, where spoofing comes from, and which providers reported.

FAQ

What does a DMARC checker do?

It looks up the DMARC, SPF, and DKIM records a domain publishes in DNS and checks them for common mistakes, such as a missing record, a policy stuck at p=none, or an SPF record over the 10-lookup limit.

If the checker shows no problems, is my email safe?

Not necessarily. Correct records are the start. Whether your real mail passes, and whether someone is spoofing you, only shows up in the DMARC reports that mail providers send. That’s what DMARC monitoring reads.

Why can’t the checker find my DKIM record?

DKIM records sit under a selector name that each sending service chooses, and DNS can’t list them. The checker tries common selectors. If yours is different, enter it in the selector field. Microsoft 365 uses selector1 and selector2.

What’s the difference between a DMARC checker and DMARC monitoring?

A checker reads your published records once. Monitoring collects the daily reports mail providers send, shows every service sending as your domain and whether it passes, and alerts you when that changes.