Email Authentication Checker (SPF, DMARC, DKIM)
Enter a domain and SysGlass checks its email-authentication posture in one pass: MX records, the SPF record and its all qualifier, the DMARC record and its policy, and DKIM keys at common selectors. It tells you whether the domain is protected against spoofing or still exposed, and gives the exact records to fix each gap. The check is read-only DNS — it never sends mail or touches your servers.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- MX records — the mail exchangers for the domain, listed with their preference values (or flags that the domain receives no email at all)
- SPF — finds the v=spf1 TXT record and reads its trailing all qualifier (-all hard fail, ~all soft fail, ?all neutral, +all pass-all)
- DMARC — finds the v=DMARC1 TXT record at _dmarc.<domain> and reads its policy tag (p=none, p=quarantine, or p=reject)
- DKIM — probes common selectors (default, google, selector1, selector2, k1, mail, dkim, s1, s2, mandrill, mailjet) for a published key
- A plain-language verdict plus concrete fixes — sample SPF/DMARC TXT records to publish and the next policy step to take
- The equivalent dig command (dig TXT <domain>; dig TXT _dmarc.<domain>) so you can reproduce the lookup yourself
How to read the result
- OK is returned only when DMARC is enforcing (p=quarantine or p=reject) AND SPF ends in a strict qualifier (-all or ~all). This is the fully-protected state.
- WARN with 'missing core email authentication' means SPF or DMARC is absent — the domain can be spoofed and needs records published.
- WARN with 'not fully enforcing yet' means both SPF and DMARC exist but aren't strict — e.g. DMARC is at p=none or SPF lacks a -all/~all qualifier.
- The SPF row shows 'present, <qualifier>' or '(none)'. A weak SPF (+all or no all qualifier) is flagged because it offers little protection.
- The DMARC row shows 'present, p=<policy>' or '(none)'. p=none is monitoring only — it reports but does not block spoofed mail.
- The DKIM row lists any selectors found, or '(no common selector found)'. A missing DKIM is informational, not a failure, because custom selectors can't be discovered from DNS.
- Findings carry a severity: warnings (no MX, no SPF, weak SPF, no DMARC) need action; info notes (DMARC in monitoring mode, no DKIM at common selectors) are advisory.
Frequently asked questions
Why does my domain show a warning even though SPF and DKIM are set up?
SysGlass returns OK only when DMARC is actually enforcing — its policy is p=quarantine or p=reject — and SPF ends in a strict qualifier (-all or ~all). If DMARC is missing, or set to p=none (monitoring only), the domain can still be spoofed, so it stays at WARN. Move DMARC to p=quarantine and then p=reject once your reports look clean.
What's the difference between -all, ~all, ?all and +all in an SPF record?
The trailing qualifier tells receivers what to do with mail from servers not listed in SPF. -all is hard fail (reject unlisted senders), ~all is soft fail (accept but mark suspicious), ?all is neutral (no opinion), and +all passes everything — which defeats the purpose. SysGlass treats -all and ~all as strict, and flags +all or a missing all qualifier as weak.
Does this tool check DKIM, and why might it say no DKIM was found?
Yes. Because DKIM selectors aren't published in a discoverable DNS record, SysGlass probes a list of common selectors (default, google, selector1, selector2, k1, mail, dkim, s1, s2, mandrill, mailjet). If your domain uses a custom selector, the key won't be found even though DKIM works — so a missing DKIM is reported as informational, not a failure.
What DMARC policy should I publish?
Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain to collect aggregate reports without affecting delivery. Once the reports show your legitimate mail passing SPF/DKIM alignment, move to p=quarantine, then p=reject for full enforcement. SysGlass only reports a fully-protected verdict at quarantine or reject.
Why does it say the domain has no MX records?
No MX records means the domain isn't configured to receive email. That can be expected for a send-only or parked domain, but if the domain is supposed to accept mail it indicates a misconfiguration. You can still publish SPF and DMARC on a send-only domain to stop it from being spoofed.
Is this email authentication checker free, and does it send any mail?
It's a free public tool at sysglass.com/tools/email-auth with no login required. It performs read-only DNS lookups (TXT and MX records) only — it never sends email, connects to your mail servers, or stores message content. You can reproduce the exact lookups with dig TXT <domain> and dig TXT _dmarc.<domain>.