Free tool
DMARC, SPF and DKIM checker. Can someone send mail as this domain?
Enter a domain to look up its SPF and DMARC records, and optionally its DKIM keys, with each one explained in plain language: what it allows, what it blocks and what is missing.
The DNS lookups go from your browser straight to Cloudflare’s public resolver (cloudflare-dns.com). AntiBait does not see which domain you check.
What it checks
Three records that decide who can send as a domain.
Email was designed without any check on the sender, so anyone can put any address in the From line. Three DNS records fix that for a domain: SPF lists the servers allowed to send its mail, DKIM publishes keys to verify its signatures, and DMARC tells receiving servers what to do when a message claiming to be from the domain passes neither.
A domain with a strict DMARC policy is hard to spoof. A domain without one, or with a policy that only monitors, can be impersonated in the From address and the message may still reach the inbox. Use this tool to check your own domain, or a sender you are unsure about.
SPF record
Which servers may send for the domain, how the record ends (-all, ~all, ?all or +all), and how many DNS lookups it needs once every include: is followed.
DMARC policy
The policy for the domain and its subdomains (none, quarantine or reject), the share of mail it applies to, alignment mode and where reports go.
DKIM keys
Optionally, public keys at common selectors and your own, with the key type and length, and whether a key is revoked or in test mode.
Plain-language explanation
Each problem is explained with what it means for spoofing and delivery, from the most serious down.
Reading the result
How to read the result.
The DMARC policy matters most: it is what turns failed SPF and DKIM checks into mail that is actually blocked.
- p=reject
- Receivers are asked to refuse mail that fails DMARC. The strongest protection against someone sending as the domain.
- p=quarantine
- Failing mail should be treated as suspicious, which usually means the spam folder.
- p=none
- Monitoring only. The domain owner receives reports, but receivers are not asked to act on spoofed mail. A normal first step, not a place to stay.
- -all and ~all
- How SPF ends. -all says that servers not listed must fail, ~all that they should be treated with suspicion. With an enforced DMARC policy either works; +all lets any server in the world pass.
- 10 DNS lookups
- SPF allows at most 10 terms that need a DNS lookup (include, a, mx, ptr, exists, redirect), nested includes counted. Above that the record is in error and SPF stops working for every message.
Questions
Common questions.
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for a domain. DKIM adds a cryptographic signature that the receiving server checks against a key published in DNS. DMARC ties both to the address in From: a message passes DMARC when SPF or DKIM passes for that same domain, and the DMARC policy says what to do when neither does.
Why does the tool not find my DKIM key?
A DKIM key lives at a name chosen by the sender, the selector, and DNS has no way to list them. The tool tries selectors that common mail services use. Find your own in the s= tag of the DKIM-Signature header of a message from your domain and enter it in the selector field.
Is p=none enough?
No. With p=none, receivers send reports but do not block spoofed mail. Start with p=none to see who sends mail as your domain, fix the legitimate senders, then move to quarantine and finally reject.
My record changed, but the tool shows the old one.
DNS answers are cached for as long as the record’s TTL, often an hour and sometimes a day. Cloudflare’s resolver may keep serving the old answer until it expires.
Does a strict DMARC policy stop all phishing?
It stops one technique: forging your exact domain in the From address. It does nothing against lookalike domains, compromised accounts or free mailboxes with your brand in the display name, which is why received mail still needs its content and links checked.
Full analysis
Not sure about the whole email? Check all of it.
This tool looks at one part of a message. The AntiBait analyzer reads the whole email: sender authentication, links and where they redirect, attachments, the text itself and the sender’s identity, and explains its verdict. You can try it for free, without creating an account.