Q: How do I check my DKIM record?

DKIM records are stored at ._domainkey. . Enter your domain and the DKIM selector (default is 'default') in the checker. The tool will look up the TXT record and verify it contains a valid public key (p=). If you don't know your selector, check your email provider's documentation — common selectors include default, google, selector1, selector2, s1, s2, and k1.

Question 1

What is SPF, DKIM, and DMARC?

Accepted Answer

SPF (Sender Policy Framework) lists which IP addresses are allowed to send email from your domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your emails so receivers can verify they haven't been tampered with. DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together with a policy that tells receivers what to do when authentication fails — reject, quarantine, or monitor.

Question 2

How do I check my SPF record?

Accepted Answer

Enter your domain name in the checker above and click 'Check records'. The tool looks up the TXT record on your domain and verifies it starts with v=spf1, checks for common issues like +all or missing ~all, and counts DNS lookups to ensure you're under the 10-lookup limit.

Question 3

How do I check my DKIM record?

Accepted Answer

DKIM records are stored at ._domainkey.. Enter your domain and the DKIM selector (default is 'default') in the checker. The tool will look up the TXT record and verify it contains a valid public key (p=). If you don't know your selector, check your email provider's documentation — common selectors include default, google, selector1, selector2, s1, s2, and k1.

Question 4

How do I check my DMARC record?

Accepted Answer

DMARC records are stored at _dmarc.<your-domain>. Enter your domain in the checker and the tool will look up the TXT record, verify it starts with v=DMARC1, check the policy (p=none, p=quarantine, or p=reject), and verify that aggregate reporting (rua=) is configured.

Question 5

What happens if SPF, DKIM, or DMARC is missing?

Accepted Answer

Without SPF, receivers cannot verify that your sending IPs are authorized, making it easier for spammers to spoof your domain. Without DKIM, emails cannot be cryptographically verified. Without DMARC, receivers have no instructions on how to handle failed authentication. Missing any of these records significantly increases the chance of your email being rejected or sent to the spam folder.

Question 6

What is BIMI and do I need it?

Accepted Answer

BIMI (Brand Indicators for Message Identification) displays your brand logo next to your emails in supported inboxes (like Gmail). It requires SPF, DKIM, and DMARC to be properly configured first. BIMI is optional but improves brand recognition and trust. For Gmail, you also need a VMC (Verified Mark Certificate).

Question 7

What is MTA-STS?

Accepted Answer

MTA-STS (Mail Transfer Agent Strict Transport Security) enforces TLS encryption for inbound email to your domain, preventing downgrade attacks where email is intercepted and sent over unencrypted connections. It works alongside TLS-RPT to report on TLS connection failures.

Question 8

Is the email authentication checker free?

Accepted Answer

Yes. MailCannon's email authentication checker is completely free. You do not need to create an account or sign up. Simply enter a domain and click check. Rate limits apply to prevent abuse.

Question 9

What is the difference between p=none, p=quarantine, and p=reject in DMARC?

Accepted Answer

p=none means monitor only — no action is taken on failed authentication, but you receive reports. p=quarantine means failed emails are sent to the spam folder. p=reject means failed emails are rejected outright. Start with p=none, review the reports, then upgrade to p=quarantine and eventually p=reject for maximum protection.

Question 10

How often should I check my email authentication records?

Accepted Answer

Check your authentication records whenever you change email providers, add new sending services, or modify DNS. For ongoing security, check at least once a month to ensure records haven't been accidentally removed or modified. If you notice deliverability drops, check immediately.

Record	DNS query	What it does
SPF	`domain.com`	Authorized sending IPs
DKIM	`selector._domainkey.domain.com`	Email signing key
DMARC	`_dmarc.domain.com`	Authentication policy
BIMI	`default._bimi.domain.com`	Brand logo in inbox
MTA-STS	`_mta-sts.domain.com`	TLS enforcement

SPF, DKIM, DMARC Checker — Email Authentication Lookup

Records We Check

How It Works

Enter your domain

Parallel DNS lookups

Validate & score

Fix with guidance

Why Use MailCannon's Authentication Checker?

SPF validation

DKIM lookup

DMARC policy check

BIMI readiness

MTA-STS enforcement

Instant results

What Is Email Authentication?

How to Fix Missing Records

Check Your Domain Now

Frequently Asked Questions