Free email authentication checker (SPF, DKIM, DMARC)
Check the SPF, DKIM, DMARC and MX records on the domain you use for course or coaching email.
It runs in your browser. Nothing is stored, and a pass does not promise the inbox. Many free DNS tools already show the raw record. This one reads it for people who send courses and coaching.
Nothing is stored. The lookup uses public DNS (Cloudflare DNS-over-HTTPS). No sign-up, no email address, and CourseSignal does not keep what you look up.
What this checker looks at
What SPF does
SPF (Sender Policy Framework) is one TXT record on your domain that lists the servers allowed to send email as you. You can only have one SPF record. It should end in -all or ~all so unlisted servers are treated as suspicious.
What DKIM does, and why a checker cannot see every key
DKIM (DomainKeys Identified Mail) signs a message. The public key is published in DNS under a name your provider chooses, called a selector. Many selectors are custom, so this page tries common names and lets you enter yours. A miss on those names is not proof that you have no DKIM.
What DMARC does
DMARC tells receiving servers what to do when mail fails SPF and DKIM alignment: p=none (monitor), p=quarantine (treat as spam) or p=reject (refuse). It can also send you reports. Since February 2024, Google and Yahoo have required bulk senders (around 5,000 or more messages a day to their users) to have SPF, DKIM and DMARC.
The SPF 10-lookup limit
Each include:, a, mx, ptr, exists and redirect makes the receiver do another DNS lookup, and nested includes count. The SPF standard caps this at 10. Above that, SPF fails with a permanent error. This checker follows includes and estimates the total.
How to read the results
- Pass: the record is present and set in a way this checker treats as sound.
- Warn: it is published, but weak, close to a limit, or not confirmed (DKIM on an unknown selector).
- Fail: missing, or broken in a way that hurts authentication. A fail does not by itself prove your last campaign went to spam.
Then work through the send, not only the DNS
Authentication is step one. The CourseSignal Email Deliverability Checklist walks through SPF, DKIM and DMARC, list hygiene, warm-up and a pre-send test for course and coaching email. It does not promise inbox placement.
Advert Paid download from CourseSignal.Sold and delivered by Payhip. More detail on the checklist page.
FAQ
Is anything stored?
No. The checks run in your browser and query public DNS through Cloudflare’s DNS-over-HTTPS service. CourseSignal has no server behind this page, nothing is stored, and we never ask for your email address.
Why does DKIM say “not found” when I have DKIM set up?
DKIM keys sit under a selector your email provider chooses, and we can only test the selectors we try. Find yours in your provider’s DKIM settings, or open a sent email, view the original and look for s= in the DKIM-Signature header. Enter it and check again.
What is the difference between -all and ~all?
~all is a soft fail: mail from servers not on your list is treated as suspicious but may still be accepted. -all is a hard fail: it should be rejected. ~all is a safe starting point; move to -all once every service that sends for you is listed.
Should I go straight to p=reject?
Usually not. Start with p=none and read the reports for a few weeks to find every service that sends as you, including ones you forgot. Then move to quarantine, and to reject once your real mail passes. Jumping straight to reject can block genuine mail.
If everything passes, will my emails reach the inbox?
Not guaranteed. Authentication shows the mail is allowed to use your domain. Placement also depends on reputation, list quality, engagement and content. A pass is the foundation, not the whole job.
How long do DNS changes take to show up?
Often minutes, sometimes a few hours, and occasionally up to 48 hours depending on the record’s TTL. If a change still does not show after a day, check the name (for example _dmarc for DMARC) and look for typos.
Related: Email authentication checker · SPF checker · DMARC checker · DKIM checker · Check if email goes to spam · Deliverability testing tools · Deliverability checklist.