About SenderAuthCheck

SenderAuthCheck is a free tool for checking the SPF, DKIM and DMARC records on a domain, with plain-English guides for setting them up for business and cold email.

What the checker does

When you enter a domain, the checker looks up:

• the SPF record (a TXT record starting with v=spf1) at the root of the domain, and every record it includes, to count DNS lookups against the limit of 10;
• DKIM public keys at selector._domainkey for the selector you enter, or for a list of common selectors if you leave it blank;
• the DMARC record at _dmarc, including whether off-domain report addresses have published the authorization record they need;
• MX records, to identify Google Workspace or Microsoft 365 and check that SPF includes the matching provider.

Each result is marked Pass, Warning, Fail or Note, with an explanation and a specific fix.

How it works

The lookups run in your browser. Your browser sends standard DNS queries over HTTPS directly to Cloudflare's public resolver (cloudflare-dns.com), and to Google Public DNS (dns.google) if Cloudflare does not answer. The answers are analyzed by JavaScript on your device.

Nothing you type is sent to this website or stored anywhere by it. There are no accounts, no analytics, no tracking cookies and no third-party scripts. The DNS resolvers receive the names being looked up, as they would for any DNS query; see their own privacy policies for how they handle query data.

What it cannot tell you

• Whether a specific message passed. DNS records only show what is published. To see how a real message was treated, check its headers (in Gmail, open the message and choose Show original).
• Whether DKIM is missing. If your provider uses a selector that is not on the common list, the checker will not find the key unless you enter the selector.
• Your sending reputation, blocklist status or inbox placement.

The organizational-domain logic (used for DMARC inheritance and off-domain report checks) uses a short list of common two-part suffixes such as co.uk rather than the full public suffix list, so unusual suffixes may be handled imperfectly.

The guides

The setup guide, DMARC policy guide and cold email domain guide cite their sources: the relevant RFCs and the published requirements from Google, Yahoo and Microsoft. Where a number is a practitioner benchmark rather than a provider rule, the guide says so.