About this tool
Review public mail-authentication and domain-security DNS signals without treating record presence as message authentication, delivery, or provider eligibility.
SPF, DMARC & Email DNS Checker looks up seven DNS names for one domain in a single request and shows the raw records next to a plain reading of what they mean. It covers the MX records, the SPF policy in the root TXT record, the DMARC record at _dmarc, CAA records, the BIMI record at default._bimi, the MTA-STS record at _mta-sts, and the TLS-RPT record at _smtp._tls. Each area is marked Configured, Needs review, Not found, or Unavailable, and the DMARC reading follows RFC 9989, which obsoletes RFC 7489 and changes how a missing p tag and the pct, rf, and ri tags are treated. The lookups run on Utiloom's server because browsers cannot query DNS directly; results come back as a report you can copy or save as JSON.
- Runs seven bounded DNS queries through one rate-limited and concurrency-limited server request, preserves exact lookup names, and returns a versioned no-store evidence report.
- Distinguishes configured, review, not-found, and unavailable states while applying RFC 7208 SPF root-policy evidence and the RFC 9989 DMARC policy, test-mode, and historic-tag model.
- Checks CAA and the DNS portions of BIMI, MTA-STS, and TLS-RPT without fetching assets, policies, certificates, mail servers, or report destinations.
- Never guesses DKIM selectors and explains that SPF recursion, DMARC organizational-domain discovery, aligned messages, SMTP delivery, inbox placement, and BIMI display remain unverified.
How to use DMARC Checker
Type a domain such as example.com or a full website URL into the Domain or website URL field; a URL is trimmed to its hostname, and entries with ports, credentials, IP addresses, or a single label are refused before anything is sent. Press Audit DNS or hit Enter. The audit has a 12-second overall deadline with 3-second resolver attempts, so most results arrive within a few seconds. Switch between the Overview, DNS records, and Scope tabs: Overview gives each area a state badge and findings, DNS records shows the exact answer text for every lookup name, and Scope lists what was not checked. A list of the standards used sits under the tabs. Use Copy for a text summary, JSON to download the full report, and Reset to start over.
When this tool is useful
- An email administrator confirming the new DMARC record has propagated before switching the policy from p=none to p=quarantine.
- A marketing operations lead checking SPF and DMARC on a sending domain before launching a campaign through a new email provider.
- A security analyst capturing MX, CAA, and TLS-RPT records for an incident ticket without opening several separate lookup tools.
- A brand manager confirming that the default._bimi record exists and points at an SVG before asking why a logo does not display.
- A consultant preparing a client onboarding report on mail authentication for a domain they do not administer.
Practical tips
- DKIM is missing on purpose: its DNS name needs a selector only the sender knows, so use the DKIM checker with a real selector instead.
- An SPF record marked Configured has not been evaluated recursively; include, redirect, and MX mechanisms still count toward the 10-lookup limit.
- A DMARC record without a p tag is read as p=none under RFC 9989, and pct, rf, and ri are now historic tags rather than errors.
- Unavailable means the resolver did not answer within the deadline, not that the record is absent; re-run after a minute before acting on it.
- MTA-STS and BIMI results only cover DNS syntax; the policy file, SVG logo, and certificate are never fetched.
Examples you can test
Load an example, compare the result with the expected output, then replace it with your own input.
Sending domain with full setup
Example input
example.com
Expected output
MX Configured with two hosts, SPF Configured ending in -all, DMARC Configured with p=reject, CAA Configured, BIMI Not found, MTA-STS Configured, TLS-RPT Configured
Not found for BIMI is a normal result for most domains; only brands that have completed logo setup will have that record.
Website URL with a DMARC problem
Example input
https://shop.example.org/checkout?ref=1
Expected output
Hostname reduced to shop.example.org; DMARC Needs review because the record has p=none and no rua address, so no aggregate reports are being collected
Organizational-domain fallback is not performed, so a subdomain with no _dmarc record shows Not found even if example.org has one.
Validation checklist
- Confirm the audited hostname is the domain in the From header, not a redirect target.
- Read the exact record text in the DNS records tab before trusting a state badge.
- Re-run after the DNS TTL expires when checking a change you just made.
- Treat Unavailable as a timeout and retry rather than a missing record.
- Check DKIM, SPF recursion, and real message headers with their own tools afterward.