Check your email authentication

Judging an SPF record by what is written in it only gets you halfway. Every include points at another record, and that record can point at more still. The budget is spent across the whole chain, so a record that looks thin on the surface can exceed the ten-lookup limit two levels down. This checker follows each include against live DNS and attributes the cost where it belongs, so nested lookups are counted rather than estimated.

The rest of the check works the same way: it reads your MX records to identify who actually handles your mail, and probes the DKIM selectors most providers publish. One limitation with this part: DKIM selectors can be custom created, so the probe only covers the commonly used ones. A selector it cannot guess shows as not found, which is worth knowing before treating an empty result as a missing record.

What you do next depends on what the check finds: the SPF record generator rebuilds a record with the budget visible as you go, and its walkthrough post follows the reasoning end to end. The DMARC report viewer shows what mailbox providers actually did with the mail claiming to be you. For everything after the snapshot — drift, new senders, spoofing attempts — DMarcus watches your domain every week for free. And if the check turned up something you would rather have diagnosed and fixed in one pass, the audit works from your live sending data.