# Free Email Authentication Tools: SPF, DKIM, DMARC, BIMI

URL: https://email-validation.org/tools/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

Four DNS records decide whether inboxes trust mail from your domain. Check what your domain publishes and read each problem in plain English with its fix, or generate a correct record to copy. Free, no account. Reads only what your domain publishes. Never sends an email.

## SPF: which servers may send

Lists the servers allowed to send mail for your domain, so receivers can tell your mail from forgeries. ([RFC 7208](https://www.rfc-editor.org/rfc/rfc7208))

[Check SPF](https://email-validation.org/tools/spf-checker/) · [Generate SPF](https://email-validation.org/tools/spf-generator/)

## DKIM: a signature on every message

Signs each message with your key, so receivers can verify it came from you and was not changed on the way. ([RFC 6376](https://www.rfc-editor.org/rfc/rfc6376))

[Check DKIM](https://email-validation.org/tools/dkim-checker/) · [Generate DKIM](https://email-validation.org/tools/dkim-generator/)

## DMARC: what happens to mail that fails

Ties SPF and DKIM to the From address and tells receivers what to do with mail that fails: deliver it, send it to spam or reject it. ([RFC 7489](https://www.rfc-editor.org/rfc/rfc7489))

[Check DMARC](https://email-validation.org/tools/dmarc-checker/) · [Generate DMARC](https://email-validation.org/tools/dmarc-generator/)

## BIMI: your logo in the inbox

Shows your logo next to your authenticated mail in inboxes that support it, once DMARC is enforced.

[Check BIMI](https://email-validation.org/tools/bimi-checker/) · [Generate BIMI](https://email-validation.org/tools/bimi-generator/)

## Where to start

1. **SPF**: List every service that sends mail as your domain.
2. **DKIM**: Turn on signing at each of those services and publish their keys.
3. **DMARC**: Publish it at p=none and read the reports. Move to quarantine, then reject, once your own mail passes.
4. **BIMI**: Add your logo last, once DMARC is at quarantine or reject for all of your mail.

Since 2024, Gmail and Yahoo require SPF or DKIM on all mail, and all three from bulk senders. See [Google's sender guidelines](https://support.google.com/a/answer/81126) and [Yahoo's sender requirements](https://senders.yahooinc.com/best-practices/).

Checking email addresses rather than domains? Try our [free email checker](https://email-validation.org/email-checker/).