Free tools
Free email authentication tools
Four DNS records decide whether inboxes trust mail from your domain. Check what your domain publishes and read each problem in plain English with its fix, or generate a correct record to copy.
- Free, no account
- Reads only what your domain publishes
- Never sends an email
- SPF
example.com TXT v=spf1 mx include:_spf.example.net ~all - DKIM
s1._domainkey TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq… - DMARC
_dmarc TXT v=DMARC1; p=reject; rua=mailto:dmarc@example.com - BIMI
default._bimi TXT v=BIMI1; l=https://example.com/logo.svg
- Step 1
SPF Which servers may send
Lists the servers allowed to send mail for your domain, so receivers can tell your mail from forgeries.
Standard: RFC 7208
- Step 2
DKIM A signature on every message
Signs each message with your key, so receivers can verify it came from you and was not changed on the way.
Standard: RFC 6376
- Step 3
DMARC What happens to mail that fails
Ties SPF and DKIM to the From address and tells receivers what to do with mail that fails: deliver it, send it to spam or reject it.
Standard: RFC 7489
- Step 4
BIMI Your logo in the inbox
Shows your logo next to your authenticated mail in inboxes that support it, once DMARC is enforced.
Where to start. One record at a time.
Set them up in this order: DMARC builds on SPF and DKIM, and BIMI on DMARC.
SPF
List every service that sends mail as your domain.
DKIM
Turn on signing at each of those services and publish their keys.
DMARC
Publish it at p=none and read the reports. Move to quarantine, then reject, once your own mail passes.
BIMI
Add your logo last, once DMARC is at quarantine or reject for all of your mail.
Since 2024, Gmail and Yahoo require SPF or DKIM on all mail, and all three from bulk senders. See Google's sender guidelines and Yahoo's sender requirements.
Checking email addresses rather than domains? Try our free email checker.
Updated · Maintained by the email-validation.org team