Email · Security

DMARC, SPF and MX checker

Check a domain's DMARC policy, SPF record and mail servers in one go and see what is missing. Free, no sign-up, live DNS.

Try: github.com bbc.co.uk stripe.com

✓

Grade Bgithub.com · 3 issue(s) · DMARC policy: quarantine

Domain	github.com
Grade	B
SPF	v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all
DMARC	v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1
DMARC policy	quarantine
MX	github-com.mail.protection.outlook.com
Issues	LOW · spfSPF uses 10 of 10 allowed DNS lookups, so one more include breaks it. Fix: Remove includes of services you no longer use before adding new ones. LOW · dkimDKIM key for selector selector1 is 1024 bits; 2048 is the current recommendation. Fix: Rotate to a 2048-bit RSA key (check that your DNS host accepts long TXT records). LOW · dkimDKIM key for selector k1 is 1024 bits; 2048 is the current recommendation. Fix: Rotate to a 2048-bit RSA key (check that your DNS host accepts long TXT records). INFO · mxOnly one MX record, so there is no backup mail server. Fix: Add a second MX with a higher priority number if your provider offers one. INFO · spfSPF ends with '~all' (softfail). This is common and acceptable when DMARC is enforced. Fix: Use '-all' once you are sure every sender is listed. INFO · mta-stsNo MTA-STS record. Inbound mail can be downgraded to unencrypted SMTP. Fix: Publish _mta-sts TXT and a policy file to require TLS (optional hardening).

Need this in bulk or inside your app?

The same data as an API: JSON, lists of hundreds of items, history and "only new" monitoring. Pay per use, free trial on the markets.

API.market →Apify →x402 for AI agents →

Example API request

curl -X POST https://radarbg.com/x402/email-dns-dmarc-spf-check \
  -H "Content-Type: application/json" \
  -d '{"domains": ["github.com"]}'
# answers 402 with the price; any x402 client pays per call in USDC on Base

Questions

What is a good result?

An SPF record ending in -all or ~all and a DMARC policy of quarantine or reject.

Is DKIM checked?

The API checks common DKIM selectors and any you give it.

Can I check many domains?

Yes, the API checks lists of domains and can report only changes.

More free tools

EU VAT number check HS code lookup VIN recall check Mortgage rates today Central bank interest rates US gas prices by state US Treasury yield curve SSL and security headers check Link preview checker