Email Authentication Toolkit
Look up, analyze, and generate SPF, DKIM, and DMARC records.
Explicit network action
Look up the public SPF record
No request made
Lookup waits for your click
Typing a domain never sends a request. You can use the local analyzer and generator below without DNS access.
Local syntax and policy checks only · 0 / 16,384 characters
Local generator
Build a reviewable SPF record
Generation creates DNS text only. It does not publish records, generate private keys, or prove mail will pass authentication.
Working notes
Use Email Authentication Toolkit with the boundary visible.
Email Authentication Toolkit constructs SPF, DKIM, and DMARC DNS names, optionally retrieves public TXT records through the disclosed Cloudflare DNS-over-HTTPS resolver, and analyzes or generates bounded records locally.
What is Email Authentication Toolkit?
Email authentication is the set of DNS-based mechanisms that let receiving mail servers verify whether an email was actually sent by the domain it claims to be from. The three core protocols — SPF, DKIM, and DMARC — work together to prevent email spoofing and phishing. SPF (Sender Policy Framework) publishes a list of authorized sending servers in a DNS TXT record. DKIM (DomainKeys Identified Mail) uses a cryptographic signature in the email header, verified against a public key in DNS, to prove the message was sent by the domain and was not altered. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together with a policy that tells receiving servers what to do when authentication fails, and where to send reports. This toolkit helps you look up existing SPF, DKIM, and DMARC records for any domain, analyze their syntax for correctness, and generate new records with a guided builder. DNS lookups use the Cloudflare DNS-over-HTTPS resolver; record analysis and generation run entirely in your browser.
When to use it
- Setting up email authentication for a new domain — generate SPF, DKIM selector, and DMARC records before publishing them in DNS.
- Auditing an existing domain — look up and analyze current SPF, DKIM, and DMARC records to identify syntax errors, weak policies, or missing records.
- Troubleshooting delivery failures — check whether SPF includes your sending service, whether the DKIM selector record exists, and whether DMARC is set to reject or quarantine.
- Migrating email providers — verify that SPF includes the new provider and that DKIM selectors are published before switching MX records.
- Training and education — look up real-world SPF, DKIM, and DMARC records to understand how email authentication works in practice.
How to use it
- 01Choose SPF, DKIM, or DMARC. Enter a domain and, for DKIM, its selector; review the exact TXT query and provider disclosure before looking it up.
- 02Paste a record or select a matching DNS answer to review syntax and cautious policy diagnostics.
- 03Configure the local generator, copy the resulting TXT value, and validate it with your mail provider before publishing it in DNS.
Common mistakes
- SPF "all" mechanism — using ~all (softfail) instead of -all (hardfail) provides weaker protection. However, switching to -all before confirming all legitimate senders are listed can cause delivery failures.
- Too many SPF lookups — SPF has a 10-DNS-lookup limit. Each "include" and "redirect" counts. Exceeding the limit causes a PermError, which fails SPF for all messages.
- Wrong DKIM selector — DKIM records are published at selector._domainkey.example.com. The selector must match what your email provider signs with. Check your provider documentation for the correct selector.
- DMARC without SPF and DKIM — DMARC requires at least one of SPF or DKIM to pass and align. Publishing a DMARC record without functioning SPF or DKIM authentication provides no protection.
- Missing DMARC rua address — without a reporting address (rua=), you receive no aggregate reports and cannot monitor authentication results for your domain.
Synthetic example
Enforcing SPF syntax
Input
v=spf1 include:_spf.example.com -all
Result
Syntax checks passed · hard fail policy detected
SPF vs DKIM vs DMARC
| Feature | Feature | SPF | DKIM | DMARC |
|---|---|---|---|---|
| What it checks | Sending server IP | Message signature | SPF/DKIM alignment with From header | |
| DNS record type | TXT on domain | TXT on selector._domainkey.domain | TXT on _dmarc.domain | |
| Survives forwarding | No (IP changes) | Yes (signature intact) | Depends on SPF/DKIM | |
| Policy enforcement | Pass/fail/softfail | Pass/fail | None/quarantine/reject | |
| Reporting | No | No | Yes (aggregate + forensic) |
Related standards
Limits and data boundary
- DNS lookup is an explicit network action: the queried name and TXT type appear in the HTTPS GET URL and Cloudflare receives normal connection metadata.
- Syntax checks do not recursively evaluate SPF, verify a DKIM signature, validate DNSSEC independently, or authenticate a message.
- Generation does not publish DNS, create DKIM keypairs, confirm report-address authorization, or replace testing with your email provider.
Frequently asked questions
- What is SPF?
- SPF (Sender Policy Framework) is a DNS TXT record that lists which servers are authorized to send email for a domain. Receiving servers check SPF to help detect forged sender addresses.
- What is DKIM?
- DKIM (DomainKeys Identified Mail) uses a cryptographic signature in the email header and a public key in DNS to let receivers verify that a message was sent by the domain it claims and was not altered in transit.
- Does this tool generate DKIM keys?
- No. The generator creates the DNS TXT record syntax for SPF, DKIM selector records, and DMARC policies. DKIM keypair generation should be done through your email provider or server.
Keep working