How it works
- Enter the domain that sends the mail. The page asks public DNS-over-HTTPS resolvers for TXT and MX records.
- SPF includes are followed so the DNS-lookup mechanisms can be counted against the usual limit of 10.
- DKIM is a check for TXT records at common selectors, plus any selector you add. A record is not proof that mail is signed.
Questions
Does this send a test email or check a blacklist?
No. It reads public DNS only. It does not send mail, open your inbox, or query a blacklist.
What is the SPF 10-lookup count?
SPF mechanisms that trigger DNS lookups, including include, a, mx, ptr, exists and redirect, are limited to 10, counting nested includes. This page counts those mechanisms. It does not evaluate SPF against a sending IP.
Why might DKIM show no record when mail is signed?
The page checks a short list of common selectors and any selector you type. A signature can use a selector that is not in that list. Finding a TXT record still does not prove a message was signed.
What does a DMARC policy of none mean?
p=none asks receivers to report failures rather than quarantine or reject the mail. This page shows the published policy. It does not apply the policy.
Which DNS service is used?
The browser requests DNS-over-HTTPS from Cloudflare, then Google’s public resolver if the first request fails. Results are whatever those resolvers return at that moment.