Enter the domain to check email authentication
Try: default, google, selector1, selector2, k1, s1
Emails Landing in Spam?
Misconfigured SPF/DKIM/DMARC causes deliverability issues. We configure and monitor email authentication.
What Is Email Authentication Validation
Email authentication validation checks whether a domain has properly configured the three core email security protocols: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting and Conformance). Together, these DNS-based protocols prevent email spoofing, phishing, and unauthorized use of your domain in email headers.
Email remains the primary attack vector for phishing and business email compromise (BEC). Without authentication protocols, anyone can send email that appears to come from your domain. SPF, DKIM, and DMARC work together to verify sender identity and instruct receiving mail servers on how to handle unauthenticated messages—making them foundational to email security.
How Email Authentication Protocols Work
SPF (Sender Policy Framework) publishes a DNS TXT record listing IP addresses and servers authorized to send email on behalf of your domain. When a receiving server gets an email, it checks the sending server's IP against the SPF record. If the IP isn't listed, the message fails SPF.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails using a private key. The corresponding public key is published as a DNS TXT record. Receiving servers use the public key to verify the signature, confirming the message was not altered in transit and originated from an authorized sender.
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together with a policy that tells receivers what to do when authentication fails: none (monitor), quarantine (spam folder), or reject (block entirely). DMARC also enables aggregate and forensic reporting, giving domain owners visibility into authentication results.
| Protocol | DNS Record | Purpose | Authentication Method |
|---|---|---|---|
| SPF | TXT on domain | Authorize sending IPs | IP address matching |
| DKIM | TXT on selector._domainkey | Sign message content | Cryptographic signature |
| DMARC | TXT on _dmarc.domain | Set policy + reporting | Alignment of SPF/DKIM |
Common Use Cases
- Domain security auditing: Verify that SPF, DKIM, and DMARC are correctly configured and aligned
- Email deliverability troubleshooting: Diagnose why legitimate emails land in spam folders
- Vendor risk assessment: Check third-party domains for proper email authentication before trust decisions
- Compliance requirements: Many frameworks (NIST, FedRAMP, CMMC) require DMARC enforcement
- Brand protection: Prevent attackers from spoofing your domain in phishing campaigns targeting customers or employees
Best Practices
- Deploy DMARC progressively — Start with p=none to monitor, move to p=quarantine, then p=reject once you've identified all legitimate sending sources
- Include all third-party senders in SPF — Marketing platforms, CRMs, and ticketing systems all need to be in your SPF record
- Keep SPF under 10 DNS lookups — The SPF specification limits DNS lookups to 10; exceeding this causes authentication failures
- Rotate DKIM keys annually — Use 2048-bit keys and rotate them periodically to limit exposure from key compromise
- Monitor DMARC reports — Aggregate reports reveal unauthorized senders and configuration issues; review them weekly
References & Citations
- Internet Engineering Task Force (IETF). (2014). Sender Policy Framework (SPF) - RFC 7208. Retrieved from https://datatracker.ietf.org/doc/html/rfc7208 (accessed January 2025)
- IETF. (2011). DomainKeys Identified Mail (DKIM) - RFC 6376. Retrieved from https://datatracker.ietf.org/doc/html/rfc6376 (accessed January 2025)
- IETF. (2015). Domain-based Message Authentication, Reporting, and Conformance (DMARC) - RFC 7489. Retrieved from https://datatracker.ietf.org/doc/html/rfc7489 (accessed January 2025)
Note: These citations are provided for informational and educational purposes. Always verify information with the original sources and consult with qualified professionals for specific advice related to your situation.
Key Security Terms
Understand the essential concepts behind this tool
SPF (Sender Policy Framework)
Email authentication method that specifies which mail servers are authorized to send email on behalf of your domain.
DKIM (DomainKeys Identified Mail)
Email authentication method that uses cryptographic signatures to verify that email content has not been tampered with in transit.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
Email validation system that builds on SPF and DKIM to prevent email spoofing and provide reporting on email authentication failures.
Phishing
A social engineering attack that uses fraudulent communications to trick recipients into revealing sensitive information or installing malware.
Frequently Asked Questions
Common questions about the Email Authentication Validator
Email authentication verifies sender identity using SPF, DKIM, and DMARC protocols. SPF lists authorized mail servers, DKIM adds cryptographic signatures, DMARC defines policy for failures. Prevents spoofing, phishing, domain impersonation. Improves deliverability - unauthenticated emails often marked spam. Required by Google/Yahoo (2024) for bulk senders. Authenticate your domain to protect brand reputation and ensure inbox delivery.
ℹ️ Disclaimer
This tool is provided for informational and educational purposes only. All processing happens entirely in your browser - no data is sent to or stored on our servers. While we strive for accuracy, we make no warranties about the completeness or reliability of results. Use at your own discretion.