SPF, DKIM and DMARC checker

Server side

Check whether a domain's mail authentication would actually stop a spoofed message

Input

Domain

The domain in the From address, not the mail server's hostname.

Resolver

Optional. Worth setting when your local resolver truncates large TXT answers.

Extra DKIM selectors

Comma separated. Microsoft 365 (selector1/selector2) and Google (google) are always tried.

This tool runs on the AdminForge server, which needs to reach the target you enter. Nothing is stored or logged. Do not paste secrets into a server-side tool on an instance you do not control.

Fill in the form and run the tool. Results appear here.

DKIM cannot be enumerated from DNS — a selector is only discoverable from a signed message's DKIM-Signature header. This tool probes the selectors that common platforms use, so a domain that signs with a custom selector will show none found even though DKIM is working. Add yours in the second field.