Enter a domain and IOn Probe looks up its email authentication records: SPF, DMARC, DKIM on common selectors, and the mail servers it uses. No signup, no email wall.
Email results are in the Security tab of the report, under DNS & Email Security.
These DNS records decide whether mail from your domain is trusted, and whether someone else can send mail that looks like yours.
The SPF record lists which servers are allowed to send mail for your domain. Receivers compare the sending server against that list.
DKIM adds a cryptographic signature to each message. Receivers fetch your public key from DNS and confirm the message was not altered.
DMARC tells receivers what to do when SPF and DKIM both fail, and where to send reports about mail claiming to be from you.
The MX records show which provider receives mail for the domain, which tells you where the other records should point.
SPF, DKIM and DMARC are DNS records that let receiving mail servers verify email claiming to come from your domain. SPF lists which servers may send for the domain, DKIM adds a cryptographic signature to each message, and DMARC tells receivers what to do when both checks fail and where to send reports.
Without them, anyone can send mail with your domain in the From line, and your own legitimate mail is more likely to land in spam.
A correct SPF record is a single TXT record on the domain that starts with v=spf1, names every service that sends mail for you, and ends with an all rule. A domain that sends through Google Workspace only would publish this:
v=spf1 include:_spf.google.com ~allThree rules cause most SPF failures:
v=spf1 include:_spf.google.com include:_spf.mx.cloudflare.net ~all.include costs lookups, and RFC 7208 caps the total at ten. Going over is also a permanent error.~all is a soft fail (accept but mark as suspicious) and -all is a hard fail (reject). Start with ~all until you are sure the list is complete.A DKIM check can report "not detected" for a working setup because DKIM keys are stored under a selector name the sender chooses, at selector._domainkey.yourdomain.com, and DNS offers no way to list selectors. A checker can only try common names, so a miss means the selector was not guessed, not that DKIM is absent.
To confirm DKIM yourself, send a message from the domain, open its full headers, and find the DKIM-Signature line. The s= value is the selector. Then query it directly:
nslookup -type=TXT selector._domainkey.yourdomain.comA reply beginning v=DKIM1 means the key is published. IOn Probe tries a set of common selectors, so treat its DKIM result as a hint and this lookup as the answer.
Start with a DMARC policy of p=none and a reporting address. That policy changes nothing about delivery but makes receivers send you reports showing who is sending mail as your domain. Once the reports show only your own services, move to quarantine, then reject.
The record is a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comFor most domains, yes. Google's email sender guidelines require every sender to Gmail to have SPF or DKIM, and since 1 February 2024 anyone sending more than 5,000 messages a day to Gmail accounts must have SPF, DKIM and DMARC, where the DMARC policy may be none. Setting up all three is also what stops other people sending mail as you.
Source: Google's email sender guidelines.
Yes. IOn Probe is free with no signup and no email wall. Enter a domain and the report opens straight away.
No. Under RFC 7208, more than one SPF record on a domain produces a permanent error, so SPF fails for every message. Merge the mechanisms into a single record that starts with v=spf1.
~all is a soft fail: mail from servers not on the list is accepted but treated as suspicious. -all is a hard fail: receivers are told to reject it. Use the soft fail until you are sure every legitimate sender is listed.
It still helps. A domain with no SPF or DMARC can be used in forged mail. Publishing v=spf1 -all and a DMARC record with p=reject tells receivers the domain sends nothing.
Free. No signup. The full report covers six pillars, not just this one.
Part of IOn Probe, the free website auditor from The IOn Project.