[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"tools-page-spf-dkim-dmarc-checker":3},{"page":4,"related":291,"variants":309},{"path":5,"name":6,"title":7,"description":8,"checkedAt":9,"sources":10,"faq":74,"related":93,"nuxter":97,"body":100,"tool":289,"preset":290},"\u002Ftools\u002Fspf-dkim-dmarc-checker","SPF, DKIM and DMARC checker","SPF DKIM DMARC Checker for Resend and Cloudflare","A free SPF DKIM DMARC checker with presets for Resend, Cloudflare Email, Google and Microsoft 365. Reads the right hosts, counts SPF lookups, explains fixes.","2026-10-06",[11,14,17,20,23,26,29,32,35,38,41,44,47,50,53,56,59,62,65,68,71],{"label":12,"url":13},"RFC 7208, Sender Policy Framework (SPF)","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7208",{"label":15,"url":16},"RFC 6376, DomainKeys Identified Mail (DKIM) Signatures","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc6376",{"label":18,"url":19},"RFC 8301, Cryptographic Algorithm and Key Usage Update to DKIM","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc8301",{"label":21,"url":22},"RFC 8463, A New Cryptographic Signature Method for DKIM","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc8463",{"label":24,"url":25},"RFC 9989, Domain-Based Message Authentication, Reporting, and Conformance (DMARC)","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9989",{"label":27,"url":28},"RFC 9990, DMARC Aggregate Reporting","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9990",{"label":30,"url":31},"RFC 7505, A \"Null MX\" No Service Resource Record","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7505",{"label":33,"url":34},"Resend docs, Cloudflare","https:\u002F\u002Fresend.com\u002Fdocs\u002Fknowledge-base\u002Fcloudflare",{"label":36,"url":37},"Resend docs, Configure a custom Return Path","https:\u002F\u002Fresend.com\u002Fdocs\u002Fdashboard\u002Fdomains\u002Fcustom-return-path",{"label":39,"url":40},"Cloudflare Email Service docs, Domain configuration","https:\u002F\u002Fdevelopers.cloudflare.com\u002Femail-service\u002Fconfiguration\u002Fdomains\u002F",{"label":42,"url":43},"Cloudflare Email Service docs, Email authentication","https:\u002F\u002Fdevelopers.cloudflare.com\u002Femail-service\u002Fconcepts\u002Femail-authentication\u002F",{"label":45,"url":46},"Google Workspace Admin Help, Set up SPF","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fsecurity\u002Fset-up-spf",{"label":48,"url":49},"Google Workspace Admin Help, Set up DKIM","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fsecurity\u002Fset-up-dkim",{"label":51,"url":52},"Microsoft Learn, Set up SPF for your Microsoft 365 domain","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Femail-authentication-spf-configure",{"label":54,"url":55},"Microsoft Learn, How to use DKIM for email in your custom domain","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Femail-authentication-dkim-configure",{"label":57,"url":58},"Amazon SES docs, Using a custom MAIL FROM domain","https:\u002F\u002Fdocs.aws.amazon.com\u002Fses\u002Flatest\u002Fdg\u002Fmail-from.html",{"label":60,"url":61},"Amazon SES docs, Creating and verifying identities","https:\u002F\u002Fdocs.aws.amazon.com\u002Fses\u002Flatest\u002Fdg\u002Fcreating-identities.html",{"label":63,"url":64},"Postmark, Adding a custom Return-Path domain","https:\u002F\u002Fpostmarkapp.com\u002Fsupport\u002Farticle\u002F910-adding-a-custom-return-path-domain",{"label":66,"url":67},"Postmark, How do I set up DKIM for Postmark?","https:\u002F\u002Fpostmarkapp.com\u002Fsupport\u002Farticle\u002F1091-how-do-i-set-up-dkim-for-postmark",{"label":69,"url":70},"Cloudflare 1.1.1.1 docs, DNS over HTTPS with JSON","https:\u002F\u002Fdevelopers.cloudflare.com\u002F1.1.1.1\u002Fencryption\u002Fdns-over-https\u002Fmake-api-requests\u002Fdns-json\u002F",{"label":72,"url":73},"Google Public DNS, JSON API for DNS over HTTPS","https:\u002F\u002Fdevelopers.google.com\u002Fspeed\u002Fpublic-dns\u002Fdocs\u002Fdoh\u002Fjson",[75,78,81,84,87,90],{"question":76,"answer":77},"What do SPF, DKIM and DMARC check?","SPF checks that the server sending a message is allowed to send for the domain in its return path. DKIM checks a signature that proves the message came from a holder of the domain's key and wasn't changed. DMARC checks that one of the two passed for a domain matching the From address, and tells receivers what to do when neither did.",{"question":79,"answer":80},"Why does my SPF check fail when I send with Resend?","Most checkers read SPF on your bare domain, but Resend puts its own subdomain in the return path, send.\u003Cdomain> unless you picked another name. Receivers read SPF there, so that is where Resend asks for the record. Choose the Resend preset and this checker reads the same host.",{"question":82,"answer":83},"What is the SPF DNS lookup limit?","SPF caps how many DNS-querying terms a receiver will evaluate for one record, counting every include, a, mx, ptr, exists and redirect, and every such term inside the records you include. Past the cap, receivers return a permanent error and SPF fails for all your mail. The table on this page gives the number, and the checker counts your record against it.",{"question":85,"answer":86},"Can you find my DKIM selector?","No checker can. DNS answers only the names you ask for and has no way to list a domain's selectors. The presets know the fixed selectors Resend, Cloudflare, Google and Microsoft use; for any other provider, copy the selector from the records it asked you to publish.",{"question":88,"answer":89},"Is the DMARC pct tag still valid?","No. RFC 9989 removed pct, along with rf and ri, and receivers following it ignore them. If you used pct=0 to test a policy, publish t=y instead.",{"question":91,"answer":92},"Which DMARC policy should I start with?","Start with p=none and a rua address, so you get reports without changing delivery. Once the reports show every sender passing, move to quarantine with t=y, then quarantine, and then reject the same way. The DMARC record generator writes each stage.",[94,95,96],"dmarc-record-generator","html-email-preview","secret-key-generator",{"body":98,"to":99},"Nuxter sends its sign-in links, password resets and account notices through Cloudflare Email Service or Resend. The presets here check the records each of them needs, so you can fix them before the first message goes out.","\u002Ffeatures",{"type":101,"value":102,"toc":279},"minimark",[103,108,112,120,123,127,138,145,149,173,190,194,218,229,233,252,256],[104,105,107],"h2",{"id":106},"what-each-record-proves","What each record proves",[109,110,111],"p",{},"SPF lists the servers allowed to send mail for a domain. Receivers check it against the domain in the return path, the envelope sender a bounce goes back to, not the From address people see.",[109,113,114,115,119],{},"DKIM signs each message with a private key. The public half sits in DNS at ",[116,117,118],"code",{},"\u003Cselector>._domainkey.\u003Cdomain>",", and a valid signature proves the message left a server holding that key and wasn't changed on the way.",[109,121,122],{},"DMARC ties both to the From address. A message passes when SPF or DKIM passes for a domain that aligns with From, and the DMARC record tells receivers what to do with mail that doesn't and where to send reports about it.",[104,124,126],{"id":125},"why-your-spf-record-is-on-a-subdomain","Why your SPF record is on a subdomain",[109,128,129,130,133,134,137],{},"Transactional providers handle bounces themselves, so they put a subdomain of yours in the return path. Resend uses ",[116,131,132],{},"send.\u003Cdomain>"," unless you chose another name when you added the domain, and Cloudflare Email Sending uses ",[116,135,136],{},"cf-bounce.\u003Cdomain>",". Receivers look up SPF on that host, so that is where the provider asks for SPF and an MX record, and a checker that reads only the bare domain reports a failure that isn't there.",[109,139,140,141,144],{},"Google Workspace and Microsoft 365 send with your own address as the return path, so their SPF belongs on the domain itself. Amazon SES uses a subdomain of ",[116,142,143],{},"amazonses.com"," until you set a custom MAIL FROM domain. Until then SPF passes for Amazon rather than for you, and DMARC has to rely on DKIM.",[104,146,148],{"id":147},"the-spf-lookup-limit","The SPF lookup limit",[109,150,151,152,155,156,155,159,155,162,155,165,168,169,172],{},"Every ",[116,153,154],{},"include",", ",[116,157,158],{},"a",[116,160,161],{},"mx",[116,163,164],{},"ptr",[116,166,167],{},"exists"," and ",[116,170,171],{},"redirect"," costs a DNS lookup when a receiver evaluates the record, and so does every such term inside the records you include. Past the limit in the table below, receivers stop with a permanent error and SPF fails for every message. Lookups that find nothing have a smaller limit of their own.",[109,174,175,176,168,178,180,181,155,183,155,185,168,187,189],{},"The checker follows each ",[116,177,154],{},[116,179,171],{}," through DNS and adds them up the way a receiver does. ",[116,182,158],{},[116,184,161],{},[116,186,164],{},[116,188,167],{}," count without being resolved. If a record is close to the limit, move a sender to its own subdomain rather than replacing its include with addresses that will change under you.",[104,191,193],{"id":192},"dmarc-after-rfc-9989","DMARC after RFC 9989",[109,195,196,197,155,200,168,203,206,207,209,210,213,214,217],{},"RFC 9989, published in May 2026, replaces RFC 7489 and puts DMARC on the standards track. Three tags are gone: ",[116,198,199],{},"pct",[116,201,202],{},"rf",[116,204,205],{},"ri",". Receivers ignore them, and the checker points them out. ",[116,208,199],{}," was mostly used as ",[116,211,212],{},"pct=0",", which some forwarders took as a cue to rewrite the From header. That job now belongs to ",[116,215,216],{},"t=y",", which asks receivers to apply the policy one level down.",[109,219,220,221,224,225,228],{},"Two tags are new. ",[116,222,223],{},"np"," sets the policy for subdomains that don't exist, and ",[116,226,227],{},"psd"," lets a domain say where its organizational boundary is. Receivers no longer need a public suffix list: when a domain has no record of its own, they walk up the DNS tree to find one. The checker does the same and shows which name the policy came from.",[104,230,232],{"id":231},"alignment","Alignment",[109,234,235,236,239,240,243,244,247,248,251],{},"DMARC passes only when SPF or DKIM passes for a domain that matches the From address. Relaxed alignment, the default, accepts any domain under the same organizational domain, so a return path of ",[116,237,238],{},"send.example.com"," aligns with mail from ",[116,241,242],{},"example.com",". Strict alignment, ",[116,245,246],{},"aspf=s"," or ",[116,249,250],{},"adkim=s",", wants the exact domain. A provider's bounce subdomain then fails SPF alignment and leaves DKIM to carry DMARC. The DKIM keys these providers ask you to publish sit under your own domain, so DKIM aligns in either mode.",[104,253,255],{"id":254},"set-up-your-provider","Set up your provider",[109,257,258,259,264,265,268,269,273,274,278],{},"Resend lists its records on the domain's page and can add them to Cloudflare DNS for you (",[158,260,263],{"href":34,"rel":261},[262],"nofollow","Resend docs","). Cloudflare Email Service adds its sending records under ",[116,266,267],{},"cf-bounce"," and its routing records on the domain itself when you onboard the domain, and it adds a DMARC record too (",[158,270,272],{"href":40,"rel":271},[262],"Cloudflare docs","). Read what that record says before you change it, and use the ",[158,275,277],{"href":276},"\u002Ftools\u002Fdmarc-record-generator","DMARC record generator"," to build the next stage.",{"title":280,"searchDepth":281,"depth":281,"links":282},"",2,[283,284,285,286,287,288],{"id":106,"depth":281,"text":107},{"id":125,"depth":281,"text":126},{"id":147,"depth":281,"text":148},{"id":192,"depth":281,"text":193},{"id":231,"depth":281,"text":232},{"id":254,"depth":281,"text":255},"spf-dkim-dmarc-checker",null,[292,296,303],{"path":276,"tool":94,"name":277,"title":293,"description":294,"summary":295,"checkedAt":9},"DMARC Record Generator with a Staged Rollout","A DMARC record generator built on RFC 9989. Roll out with t=y instead of pct, set np and report addresses, compare with your live record and build SPF too.","Build a DMARC record step by step, roll it out in stages and compare it with the one you publish.",{"path":297,"tool":95,"name":298,"title":299,"description":300,"summary":301,"checkedAt":302},"\u002Ftools\u002Fhtml-email-preview","HTML email preview","HTML Email Preview: Desktop, Mobile and Dark Mode","A free HTML email preview: see your email at desktop and mobile widths in light, dark and forced dark, with checks for Gmail clipping, alt text and links.","See a transactional email at desktop and mobile widths, in light and dark, with checks for clipping, alt text and links.","2026-10-07",{"path":304,"tool":96,"name":305,"title":306,"description":307,"summary":308,"checkedAt":9},"\u002Ftools\u002Fsecret-key-generator","Secret key generator","Secret Key Generator for .env, JWT and Webhooks","Generate random secret keys in your browser for NUXT_SESSION_PASSWORD, Better Auth, JWT and webhook signing, as hex, base64, base64url or letters and digits.","Secrets for NUXT_SESSION_PASSWORD, Better Auth, JWT and webhooks, as hex, base64 or base64url, with the .env and Wrangler lines.",[]]