Free tools
DNS and Email Records
Look up a domain's SPF, DMARC, DKIM, MX, CAA and address records and read them the way a tester does: what each one allows, and what to change.
This tool makes network requests
Unlike the other tools here, this one has to ask DNS. When you press Look up, your browser sends DNS over HTTPS queries to Cloudflare's public resolver at https://cloudflare-dns.com/dns-query, as GET requests with accept: application/dns-json.
Each query carries one DNS name and a record type. The names are the domain you enter, names built from it (_dmarc., the DKIM selector, its parent names for CAA), and any names the domain's own SPF record includes. Nothing else is sent: no cookies, no referrer, nothing about you beyond the IP address any DNS resolver sees. No other host is contacted.
Results
Records and what they mean appear here, one section per record type.
Reading the results
- SPF ending in +all, ?all, ~all or -all
- +all lets every server on the internet send as the domain, which is worse than no record. ?all gives no verdict. ~all is fine when DMARC enforces; -all is strict on its own.
- Too many SPF lookups
- SPF allows ten DNS lookups, counted through every nested include. Past ten, receivers return a permanent error and SPF fails for all mail, so the record quietly stops working. The tool follows the includes and counts.
- DMARC p=none, quarantine, reject
- p=none only collects reports, and spoofed mail is still delivered. quarantine sends it to spam. reject refuses it. The path is none, read the reports, fix real senders, then quarantine and reject.
- Missing DKIM selector
- DKIM keys sit at <selector>._domainkey.<domain>, and nothing in DNS lists the selectors. Take the s= value from a DKIM-Signature header in a real message. No selector here does not mean no DKIM.
- CAA absent
- Any public certificate authority may issue for the domain. A CAA record limits issuance to the CAs you use, so a mistake or a social engineering attempt at another CA fails.
- A domain that sends no mail
- It still needs records, because unprotected domains get spoofed. Publish v=spf1 -all, DMARC p=reject and a null MX (0 .).
Answers come from one resolver at one moment. A record changed in the last few minutes may still show its old value until the TTL runs out.