# Email authentication checker.

URL: https://samva.dev/tools/email-auth-checker

Free tool

Look up a domain's MX, SPF, DKIM, DMARC, and BIMI readiness in one pass. See the evidence, what passes, and what to fix.

Enter a domain and an optional DKIM selector, then check records. Leave the selector blank to probe the selectors most providers use.

The result inspects MX, SPF, DKIM, DMARC, and BIMI readiness with DNS and asset evidence, what passes, and what to fix.

## Three records prove your mail is yours.

How it works

- **SPF**: SPF lists the servers allowed to send mail for your domain. A receiver checks the sending server against that list and flags mail that comes from anywhere else.
- **DKIM**: DKIM signs each email with a private key. The receiver fetches the matching public key from your DNS and confirms the email arrived unaltered.
- **DMARC**: DMARC ties SPF and DKIM together. It tells receivers what to do when an email fails both, and sends you reports on who is sending mail as your domain.

## Common questions

### What is an email authentication checker?

It looks up the DNS records that prove an email came from your domain: SPF, DKIM, and DMARC. Enter a domain and you get each record, whether it is configured, and what to change if it is not.

### What are SPF, DKIM, and DMARC?

SPF lists the servers allowed to send mail for your domain. DKIM signs each email so receivers can confirm it arrived unaltered. DMARC tells receivers what to do when an email fails both checks, and reports back on who sends mail as you.

### What does the BIMI readiness check prove?

It verifies the public BIMI record, the effective DMARC enforcement policy, and safely decoded facts from the declared logo and mark certificate. It cannot prove that a real email aligned, that every receiver trusts the certificate, or that a provider will display the logo.

### Why does my domain need all three?

SPF and DKIM each cover one angle of forgery, and an email can pass one while failing the other. DMARC ties them together and sets the enforcement policy. Mailbox providers weigh all three when they decide inbox or spam.

### Which DKIM selector should I enter?

Whoever sends your mail sets the selector. Open an email you sent, find the \`DKIM-Signature\` header, and read the \`s=\` value. Leave the field blank and this tool probes the selectors that common providers use.

### Does a passing check guarantee my mail reaches the inbox?

No. Passing records get your mail evaluated; sender reputation, list hygiene, content, and engagement decide placement from there. Failing records hold mail back before any of that matters.

### How often should I recheck these records?

Recheck whenever you add a sending service, rotate a DKIM key, or move DNS providers. A quarterly pass catches records that a vendor change quietly broke.

## Send from a domain that passes.

Samva walks you through SPF, DKIM, and DMARC on your own domain, then feeds bounces and complaints into suppression so your reputation holds as volume grows.

[Start sending](https://samva.dev/signup)

[Read the docs](https://samva.dev/docs)