Email authentication checker: SPF lookups, DMARC, DKIM

Type a domain and this page reads its public DNS from your browser through Cloudflare's DNS-over-HTTPS service. It counts SPF DNS lookups the way RFC 7208 section 4.6.4 does, shows what each sender in your SPF record costs, reads the DMARC policy, and looks for DKIM keys under 24 common selector names. Only the domain you type is sent, and it goes to Cloudflare's resolver, not to us. It never changes anything.

What this does and does not tell you

• SPF lookups are counted from live DNS at the moment you click: each include, a, mx, ptr, exists and redirect costs one; ip4, ip6 and all cost none. More than 10 is a permerror, so SPF fails for every message. Terms that use macros (for example Salesforce's exists:%{i}... record) are counted as one lookup but cannot be followed.
• DKIM selectors are guessed from a list. A sender can use any selector name, so "none found" is not "DKIM is off". The real proof is the Authentication-Results header of a message you received.
• DNS cannot show your mail. It does not know who really sends as your domain; DMARC reports (the rua address) do.

Rather than reading the result yourself? Mail Auth Fix Sheet ($39, within 24 hours) writes the exact records to publish for your senders, from each vendor's current setup page. Over the lookup limit? Read SPF "too many lookups": the three fixes in order. The checker's code is MIT licensed: mailauth-check on GitHub.