SPF, DKIM and DMARC checker

Type your domain (or any email address) and press Check. FernTool reads the domain’s SPF, DMARC and DKIM records and tells you in plain words whether scammers can send email pretending to be you, and exactly what to add if they can.

Why this matters

Email was designed without any proof of who sent it. Anyone can write “From: accounts@yourbusiness.co.za” on a message, which is how most invoice-fraud and phishing scams work. Three DNS records fix this. Without them, your real emails are also more likely to land in spam, because Gmail, Outlook and Yahoo trust domains that prove who they are.

What each result means

SPF (Sender Policy Framework) is one TXT record listing the services allowed to send as you, ending in ~all or -all. A domain may have only one, and it may trigger at most 10 DNS lookups; go over that and SPF silently breaks. We count them for you.
DKIM (DomainKeys Identified Mail) puts a digital signature on every email, checked against a public key in your DNS. Your email provider gives you the record; you just switch it on.
DMARC ties it together and is the only one that protects the From address people actually see. p=none = watch only, p=quarantine = fakes go to spam, p=reject = fakes are refused.

The safe order to set it up

Add or fix SPF so it includes every service that sends as you (mail host, newsletter tool, website forms, accounting software).
Switch on DKIM in your email admin (Google Workspace: Apps → Gmail → Authenticate email; Microsoft 365: Defender → Email authentication → DKIM).
Add DMARC with p=none and a report address. Wait 2 to 4 weeks.
When the reports show your own mail passing, change to p=quarantine, then p=reject.

Domains you own but never use for email (old brands, typo domains) should get v=spf1 -all and v=DMARC1; p=reject straight away, because scammers love unused domains.

Honest limits

We read public DNS records, so we can tell you whether a domain has told the world how to spot fakes. We can’t see whether a particular email passed, or whether a mailbox has been hacked (a hacked account sends “real” email that passes every check). DKIM keys hide under a name chosen by your provider; we try 14 common ones, and you can enter yours above.

Frequently asked questions

What do SPF, DKIM and DMARC do?

SPF lists the servers allowed to send email for your domain. DKIM adds a tamper-proof signature to each message. DMARC tells receiving servers what to do when an email claims to be from you but fails those checks: deliver it anyway (p=none), send it to spam (p=quarantine) or refuse it (p=reject).

Is SPF enough to stop spoofing?

No. SPF only checks the hidden “envelope” sender, not the From address people see. Without a DMARC policy of quarantine or reject, a scammer can still put your domain in the From line.

Why does the checker say no DKIM was found?

DKIM keys live under a name (a selector) that only your email provider knows, such as “google” or “selector1”. We try the common ones. If yours is different, open an email you sent, view the original message and look for s= in the DKIM-Signature header, then enter that selector.

Will DMARC p=reject stop my own email?

It can if some of your real email (newsletters, invoices, website forms) isn’t covered by SPF or DKIM. That’s why you start with p=none, read the reports for a few weeks, fix what fails, then move to quarantine and reject.

Do Gmail and Yahoo require DMARC?

Since 2024 Gmail and Yahoo require anyone sending more than 5,000 emails a day to them to have SPF, DKIM and a DMARC record. Smaller senders also get better delivery with all three in place.

Related tools and guides

API: GET /api/email-security/{domain}?selector= · MCP tool check_email_security.