8 min read
SPF record syntax explained
Every SPF mechanism and qualifier, with examples, and how to stay under the 10-lookup limit.
Check, understand and fix your domain
One input runs every check: DNS and DNSSEC, SPF, DKIM, DMARC, BIMI and mail transport, TLS, HTTP security headers, registration and performance. Every finding is explained in plain language and comes with the exact record or configuration to fix it.
No account, no email addressFull report in secondsRead-only checks from published IPsEvery deduction is documented
Your recent checks
About this list
This list is kept in your browser, not by us. We have no record of which checks you have run.
The reports themselves are on our servers, until they are deleted automatically after 14 days. Removing a row here does not delete the report — the menu on each row can do that. A report you delete leaves this list: its row stops being a link to it straight away, and is gone the next time this page loads.
The list holds at most 20 domains. Checking one more drops the oldest row — the report itself is not deleted, but this list stops being the way back to it, so bookmark the link for any report you want to keep.
The list is not a backup: to keep one report, bookmark its link. Safari also clears this list if you do not come back for a week or so.
| Domain checked | Actions |
|---|
Query, validate and troubleshoot DNS records for any domain.
DNSDNS LookupQuery any DNS record type for a domain and compare authoritative and resolver answers.DNSDNS Health CheckerAudit a domain's DNS configuration for missing records, delegation problems and common misconfigurations.DNSDNS Propagation CheckerSee what a range of public resolvers return for a record and understand any lag between them.DNSDNSSEC CheckerValidate the DNSSEC chain of trust from the root to your zone and explain any broken link.DNSCAA Record CheckerCheck which certificate authorities are allowed to issue for your domain and spot missing or conflicting records.
Check and build SPF, DKIM, DMARC, BIMI and mail delivery records.
EmailMX LookupList the mail servers for a domain, confirm they respond, and check whether they offer STARTTLS.EmailSPF CheckerValidate your SPF record, visualize the include tree and count DNS lookups against the 10-lookup limit.EmailDKIM CheckerFind and validate DKIM public keys by trying common selectors or the one you provide.EmailDMARC CheckerRead your DMARC record, explain every tag, and say what the published policy does and does not ask receivers to do.EmailBIMI CheckerCheck your BIMI record and logo, and whether your DMARC policy meets the prerequisites.EmailMTA-STS CheckerValidate your MTA-STS DNS record and policy file so inbound mail cannot be downgraded to plain text.EmailTLS-RPT CheckerCheck whether your domain publishes a TLS-RPT record so you receive reports about failed secure mail delivery.EmailSMTP TLS CheckerConnect to a mail server and check STARTTLS support, certificate validity and the negotiated protocol.EmailEmail Header AnalyzerPaste raw email headers to see the delivery path, hop delays, authentication results and phishing red flags.
Security
All security tools →Inspect TLS certificates, HTTP security headers and exposed ports.
SecuritySSL CheckerInspect the TLS certificate chain, expiry, protocols and cipher suites of any host and get a grade.SecuritySecurity Headers CheckerCheck HSTS, CSP, X-Frame-Options and cookie flags, with copy-paste fixes for common servers.SecurityPort CheckerCheck which of 21 common TCP ports answer on a host you run, and what each open one exposes.
Test HTTP behavior, redirects, speed, SEO markup and the site's technology.
WebHTTP Header CheckerView the full request and response headers for any URL, including caching, compression and server details.WebRedirect CheckerFollow every redirect hop with status codes, timing and headers, and spot loops and chains.WebDomain Health CheckRun every DNS, email, TLS and web security check in one go and get a single grade with a plain-language fix list.WebWebsite Speed TestSee what real Chrome visitors experience, and which bytes on one page load are worth removing.WebSEO CheckerCheck one page's indexability, canonical, metadata, headings, structured data, robots.txt and sitemap.WebTechnology LookupIdentify the CMS, framework, server, CDN and analytics a site discloses, with the evidence for each.
Network
All network tools →Look up reverse DNS and check IP or mail server blacklists.
Domain
All domain tools →Look up WHOIS and RDAP registration data and domain age.
Generators
All generators tools →Build valid DNS, email and security records from a simple form.
GeneratorsSPF Record GeneratorAnswer a few questions about who sends your mail and get a valid SPF record with provider-specific instructions.GeneratorsDMARC Record GeneratorBuild a DMARC record step by step, from monitoring to full enforcement, with reporting addresses included.GeneratorsDKIM Record GeneratorTurn a DKIM public key and selector into a correctly formatted DNS TXT record.GeneratorsMX Record GeneratorGenerate correctly prioritized MX records for a mail provider, ready to paste into your DNS host.GeneratorsCAA Record GeneratorBuild a correct CAA record naming the certificate authorities allowed to issue TLS certificates for your domain.GeneratorsTXT Record GeneratorBuild a correctly formatted and escaped DNS TXT record for verification, SPF or any custom value.GeneratorsMTA-STS GeneratorGenerate the MTA-STS DNS record and the HTTPS-hosted policy file it depends on, together.GeneratorsTLS-RPT Record GeneratorGenerate a valid TLS-RPT DNS record so senders report on TLS delivery failures to your mail servers.GeneratorsBIMI Record GeneratorGenerate a valid BIMI DNS record pointing to your SVG logo and optional Verified Mark Certificate.GeneratorsSecurity Headers GeneratorAnswer a few questions about your site and get security header config snippets for common web servers.GeneratorsSSL Config GeneratorGenerate a modern TLS protocol and cipher suite configuration for your web server, based on your compatibility needs.Generatorssecurity.txt GeneratorGenerate a valid security.txt file with your vulnerability disclosure contact, policy link and expiry date.
Guides
All guides →9 min read
How to set up DMARC, step by step
A staged setup plan from monitoring to full enforcement, with report review checkpoints at each stage.
5 min read
DKIM key rotation
How to rotate DKIM keys safely, without breaking mail already in flight, using selector overlap.
5 min read
How MTA-STS and TLS-RPT work together
How MTA-STS enforces encrypted mail delivery and TLS-RPT gives you visibility into failures, and why they pair together.
5 min read
How to read a DNS lookup result
A plain-language walkthrough of record types, TTLs and authoritative versus resolver answers.
5 min read
BIMI requirements explained
Every BIMI requirement explained: DMARC enforcement, the SVG logo format, and when a Verified Mark Certificate matters.