DNS Lookup
Enter a domain: A, MX, SPF, DKIM, DMARC, DNSSEC and more, checked in seconds.
What the tool checks
SPF
syntax of every term, dangerous mechanisms (+all, ptr), multiple records, overlapping IP ranges, and the DNS lookup count (limit of 10) following every include.
DKIM
key presence and size (RSA 1024 vs 2048, Ed25519), truncated or revoked keys, test mode, and selectors guessed from your provider (Google, Microsoft 365, OVH, Zoho, Proton…).
DMARC
every tag (p, sp, pct, adkim, aspf, rua, ruf, fo…), policy consistency, organisational domain inheritance and authorisation of report addresses hosted elsewhere.
MX
hosts that resolve, no CNAME aliases, non-routable addresses, null MX, duplicates and redundancy.
The rest
A, AAAA, NS, SOA, CAA, DNSSEC, MTA-STS, TLS-RPT, BIMI, misplaced TXT — and a recap of every duplicate.
How to read the report
Each check shows a status (compliant, information, warning or error), the records actually published and, for each finding, the explanation and the fix. Errors make a record invalid or ineffective; warnings are risks or bad practice; information is neutral.
FAQ
Why is my SPF "too long" when it fits on one line?
The limit is not about length but about the number of DNS lookups triggered by include, a, mx, ptr, exists and redirect, nested includes included: 10 at most (RFC 7208). Beyond that the SPF is invalid (PermError).
How do I find my DKIM selector?
Open a message received from your domain, view its headers and look for DKIM-Signature: the s= field holds the selector. Otherwise leave the field empty: the tool tries your provider's selectors, then common names.
Are two SPF records a problem?
Yes: a domain must publish a single SPF. With two, receivers return a permanent error and SPF fails. Merge them into one.