// the lab · dmarc checker
Check any domain’s DMARC, SPF and DKIM in one go, plus MX, MTA-STS, TLS-RPT and BIMI. Get a grade, plain-English fixes and a ready-to-paste DMARC record for your next step.
$ checks dmarc · spf · dkim · mx · mta-sts · bimi
$ dns 1.1.1.1 over https
$ stored nothing
// how it works
01
Type a domain or an email address. If you know your DKIM selector (the s= value in an email header), add it for a definite answer.
02
Every record is checked: DMARC policy and reports, SPF syntax and the 10-lookup limit, DKIM key size, mail provider and the optional extras.
03
Each problem comes with a plain-English fix and, where it helps, a record you can paste into your DNS. Share the result link with whoever manages your DNS.
// the road to p=reject
Jumping straight to reject can block your own invoices and newsletters. This order avoids that.
| step | record | what to do |
|---|---|---|
| 1 · monitor | p=none; rua=mailto:… | Publish SPF and DKIM for every service that sends your mail, then collect reports for 2-4 weeks. |
| 2 · fix | p=none | Use the reports to find forgotten senders (CRM, invoicing, website forms) and authenticate them. |
| 3 · quarantine | p=quarantine | Failing mail goes to spam. Optionally start with pct=25 and raise it. |
| 4 · reject | p=reject | Spoofed mail is refused outright. Keep reading reports for new senders. |
// faq
DMARC is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks: deliver it, send it to spam, or reject it. Without it, anyone can send email that looks like it came from you. Google, Yahoo and Microsoft now require DMARC from bulk senders.
SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature to each message. DMARC checks that at least one of them passes and matches the visible From address, then applies your policy and sends you reports.
Start with p=none and a rua address to collect reports, fix any legitimate service that fails, then move to quarantine and finally reject. A domain that never sends email can go straight to p=reject.
SPF allows at most 10 DNS lookups, counting every include, a, mx, ptr, exists and redirect, including those inside included records. Above 10, SPF returns a permanent error and fails. Remove services you no longer use or replace includes with IP ranges.
DKIM keys are published under a selector name that only your mail provider knows, such as selector1 for Microsoft 365 or google for Google Workspace. The checker tries 42 common selectors. If yours is custom, open a sent email, find s= in the DKIM-Signature header and enter it in the selector box.
The lookups run in your browser over DNS-over-HTTPS to Cloudflare (with Google as a fallback). roosho.com never sees which domain you check, and nothing is logged or stored. DNS records are public, so checking someone else’s domain is normal.
MTA-STS forces other servers to use encrypted TLS when delivering mail to you, and TLS-RPT sends you reports when that fails. BIMI lets supporting inboxes show your logo next to your emails, but only once DMARC is at quarantine or reject.
// more from the lab
Built by roosho, a jack of all IT trades. Runs in your browser. No account, no upload.
