Full e-mail authentication check
Can someone send e-mail in the name of a domain? See every record that answers it at once, SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI, with an overall verdict, what each finding means and what to change.
Working on one record? The SPF checker, the DMARC checker and the DKIM checker go into the detail of each one, with the error messages and their fixes.
The DNS lookups go straight from your browser to public resolvers (Cloudflare, Google): we see nothing.
Questions
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for a domain. DKIM signs each message with a key published in the DNS. DMARC ties both to the address people see in From, and tells receivers what to do when neither matches: deliver, send to spam, or refuse.
Why does the number of DNS lookups matter?
Each include, a, mx, ptr, exists and redirect makes the receiver look something up, and SPF stops at 10. Past that, the result is an error and SPF fails for all your mail, often after adding one more service.
Why is no DKIM key found?
DKIM keys live under a name chosen by your provider (the selector), which cannot be listed. We try the common ones; if yours is different, find it in the DKIM-Signature header of a message you sent (s=) and type it above.