DOpen Data Tools
Email · Security

DMARC, SPF and MX checker

Check a domain's DMARC policy, SPF record and mail servers in one go and see what is missing. Free, no sign-up, live DNS.

✓
Grade Abbc.co.uk · 0 issue(s) · DMARC policy: reject
Domainbbc.co.uk
GradeA
SPFv=spf1 ip4:212.58.224.0/19 ip4:132.185.0.0/16 +include:spf.sis.bbc.co.uk +include:spf.messagelabs.com ~all
DMARCv=DMARC1;p=reject;aspf=s;adkim=s;pct=100;fo=0;ri=86400; rua=mailto:dmarc_agg@vali.email;
DMARC policyreject
MX
  • cluster1.eu.messagelabs.com
  • cluster1a.eu.messagelabs.com
Issues
  • INFO · spfSPF ends with '~all' (softfail). This is common and acceptable when DMARC is enforced. Fix: Use '-all' once you are sure every sender is listed.
  • INFO · dkimNo DKIM key found for the common selectors (google, selector1, selector2, default, k1, s1, mail). A domain can use any selector name, so this does not prove DKIM is missing. Fix: Pass your selector in dkimSelectors to check it.
  • INFO · mta-stsNo MTA-STS record. Inbound mail can be downgraded to unencrypted SMTP. Fix: Publish _mta-sts TXT and a policy file to require TLS (optional hardening).

Need this in bulk or inside your app?

The same data as an API: JSON, lists of hundreds of items, history and "only new" monitoring. Pay per use, free trial on the markets.

Example API request
curl -X POST https://radarbg.com/x402/email-dns-dmarc-spf-check \
  -H "Content-Type: application/json" \
  -d '{"domains": ["github.com"]}'
# answers 402 with the price; any x402 client pays per call in USDC on Base

Questions

What is a good result?

An SPF record ending in -all or ~all and a DMARC policy of quarantine or reject.

Is DKIM checked?

The API checks common DKIM selectors and any you give it.

Can I check many domains?

Yes, the API checks lists of domains and can report only changes.

More free tools

EU VAT number checkHS code lookupVIN recall checkMortgage rates todayCentral bank interest ratesUS gas prices by stateUS Treasury yield curveSSL and security headers checkLink preview checker