Email Authentication Checker
Check SPF, DKIM, and DMARC in one go. Verify alignment, detect inconsistencies between protocols, and get a complete authentication overview.
What is email authentication?
Email authentication is a set of DNS-based protocols that work together to verify that an email was actually sent by someone authorized by the domain owner. The three core protocols are:
- SPF — verifies the sending server's IP address is authorized
- DKIM — verifies the message hasn't been tampered with using cryptographic signatures
- DMARC — ties SPF and DKIM together with a policy and reporting
Each protocol covers a different attack vector. SPF alone can be bypassed by email forwarding. DKIM alone doesn't prevent unauthorized servers from sending. DMARC alone is useless without SPF or DKIM. Together, they provide defense in depth.
The alignment trap
Your SPF is green. Your DKIM is green. But DMARC still fails. How? Because of domain alignment — the most commonly missed aspect of email authentication.
DMARC requires that at least one of SPF or DKIM not only passes but also aligns with the From: header domain. If your SPF passes for sendgrid.net but your email's From: says @yourdomain.com, DMARC alignment fails. Most single-protocol checkers won't tell you this.
Full-stack email authentication monitoring — one dashboard, all protocols, all domains. Join the Sendvery beta.
Frequently asked questions
Email authentication is a set of DNS-based protocols (SPF, DKIM, DMARC) that verify the sender is authorized by the domain owner. Together they prevent spoofing and improve deliverability.
SPF validates the sending server, DKIM validates message integrity, DMARC ties them together with policy and reporting. Each alone has weaknesses — together they provide comprehensive protection.
Alignment means the domain used by SPF or DKIM matches the From: header domain. Even if SPF and DKIM pass, DMARC fails if neither is aligned with the visible sender domain.
SPF passes for the sending service domain (e.g., sendgrid.net) but not aligned with your From: domain. Configure your sending service to use your domain for SPF and DKIM signing.
Want ongoing monitoring?
Checking once is a start. But email authentication breaks silently over time. Get alerted the moment something changes.
Free plan includes 1 domain. No credit card required.