DMARC / SPF / DKIM Analyzer
Type a domain (or paste a record) and get every DMARC, SPF or DKIM tag explained, misconfigurations flagged, and the SPF 10-lookup budget counted.
✓ runs in your browser — pasted data never leaves this page; the optional DNS fetch uses our server (disclosed below)
⚠ Optional — the fetch sends _dmarc.yourdomain.com from our server to Cloudflare's
public resolver (never stored, rate-limited). Prefer to stay fully local? Get the record with
nslookup -type=txt _dmarc.yourdomain.com and paste it below — pasted text never leaves your browser.
Frequently asked
Type a domain or paste a record — what's the difference?
Pasting keeps everything in your browser: the record is analyzed in WebAssembly and nothing is sent anywhere. The fetch-by-domain button instead sends the DNS name to our server, which asks Cloudflare's public resolver and returns the record — never stored, and your browser never contacts a third party.
Where do I find my DKIM selector?
In a sent message's DKIM-Signature header: the s= tag. Microsoft 365 uses selector1/selector2; Google Workspace typically uses google.
What's the SPF 10-lookup limit?
SPF evaluation may trigger at most 10 DNS lookups (include, a, mx, ptr, exists, redirect). Beyond that receivers return permerror — a silent SPF failure that surprises many tenants.