Email Authentication Checker Widget

Help readers fix email deliverability: this widget checks a domain's SPF record, DMARC policy and DNSSEC signing in one step and explains each result in plain language, with the raw records shown for anyone who needs to edit DNS.

Website & Security Live check Checked by A2Z server Free · no ads

Customize your widget

Theme
Auto follows the visitor's light/dark setting.
Style
Attribution on your page
Optional and entirely your choice. The exact line is shown in the code below; it links to the tool with rel="nofollow".
More options
Starting values
Leave blank to use the widget's defaults. Visitors can still change every value.

Live preview

Exactly what your visitors will see

Embed code

<iframe src="https://a2z.tools/embed/w/email-auth-checker" title="Email Authentication Checker by A2Z Tools" width="100%" height="560" style="border:0;width:100%" loading="lazy" allow="clipboard-write"></iframe>

A plain iframe. Works everywhere, including site builders that strip scripts. Adjust height if your content needs more room.

Works with

How it works

The widget runs A2Z's SPF, DMARC and DNSSEC checks for the domain in parallel - the code behind the corresponding badges - and lists what was found: the SPF record with its all mechanism and lookup count, the DMARC policy and where it was inherited from, and whether the zone is signed and validates. These are DNS reads only; no email is sent and nothing on the domain is changed. Because DKIM keys live under selector names that only the sender knows, DKIM is left to the full checker, where a selector can be entered.

What is checked

  • SPF: v=spf1 TXT record, all mechanism and the 10-lookup limit (RFC 7208)
  • DMARC: v=DMARC1 at _dmarc.<domain> or the organisational domain; p= policy (RFC 7489)
  • DNSSEC: DS at the parent zone and a validating-resolver result (RFC 4033)

Worked examples

A well-configured sender

Inputs: SPF "v=spf1 include:_spf.google.com -all", DMARC p=reject, zone not signed

Result: SPF OK (-all); DMARC OK (p=reject); DNSSEC Attention (not signed)

An unsigned zone is common and is shown as Attention, not Problem.

A domain in monitoring mode

Inputs: SPF ending ~all with 12 lookups, DMARC p=none

Result: SPF Problem (too many lookups); DMARC Attention (p=none)

Too many lookups makes SPF fail for all mail, so it is the first thing to fix.

Limitations

  • DKIM is not checked here because it needs the sender's selector name.
  • Does not read DMARC reports or test real message delivery.
  • DNS answers can be cached for their TTL, so recent DNS changes may take time to appear.

Where publishers use it

  • Email marketing blogs
  • IT support knowledge bases
  • Deliverability consultants' sites

Questions

What about BIMI and MTA-STS?

They build on these three. BIMI needs DMARC at quarantine or reject before brand logos can appear in inboxes, and MTA-STS protects mail in transit between servers. Both are separate checks in the A2Z network tools.

What does the sp= tag in DMARC do?

It sets a separate policy for subdomains. Without it, subdomains inherit p=. The full record is shown so you can see whether a stricter or looser subdomain policy applies.

Does it check DKIM?

Not here, because DKIM needs the selector name, which differs by sending service. The full A2Z DKIM checker accepts a selector.

Why do the results differ from another tool?

DNS answers are cached for up to their TTL and A2Z also caches results for six hours, so a record changed minutes ago may not appear yet.

What should I fix first?

An SPF record over the 10-lookup limit, because it makes SPF fail for every message. Then move DMARC from p=none towards quarantine or reject once reports look clean.

Sources

  1. RFC 7208 - Sender Policy Framework (SPF) - IETF . Section 4.6.4: the 10 DNS-lookup limit.
  2. RFC 7489 - DMARC - IETF . Policy discovery, including fallback to the organizational domain.
  3. RFC 4033 - DNS Security Introduction and Requirements (DNSSEC) - IETF

Cite or recommend this tool

If you reference this tool in an article, course or documentation, these formats are ready to copy. They are optional - nothing is added to your site unless you paste it.

A2Z Tools Email Authentication Checker
https://a2z.tools/dmarc-checker

Related widgets

More Website & Security widgets →

Preview

CustomizeGet code