Skip to content
correct.email
correct.email
RFC 9989DMARC checks follow RFC 9989, the standard published in 2026

Your email infrastructure. Finally, understood.

Check SPF, DKIM, DMARC and MX in one pass. Every result is read live from DNS, explained in plain language and ends with the exact change to make.

A domain such as example.com. You can paste a URL or an email address.

Runs the SPF, DMARC and MX checks together. Checked domains are not stored.

  • Live DNSNo stored reports. Answers are never more than 30 seconds old.
  • No sign-upFree to use. Checked domains are not stored or logged.
  • Standards, citedEvery finding links to the RFC behind it.
Examplenorthwind.example

Example report

  • 2 with warnings
  • 2 passed

SPF checker

Warning

8 of 10 DNS lookups8/10

TXT northwind.example

v=spf1 include:_spf.google.com include:mail.zendesk.com include:sendgrid.net ptr1 ~all

  • Warning: The ptr mechanism is used (1×)

    Replace ptr with ip4/ip6 ranges or an include for the sending service.

  • Warning: 8 of 10 DNS lookups used

    Review whether every include is still needed.

2 more findings

  • Note: Unauthorized senders soft-fail (~all)

  • Pass: The SPF syntax is valid

Open the full SPF checker

DMARC checker

Warning

Mail that fails DMARC is delivered normally (monitoring only).

TXT _dmarc.northwind.example

v=DMARC1; p=none;1 rua=mailto:dmarc@northwind.example; fo=1;

  • Warning: Policy “none”: failing mail is still delivered

    Once aggregate reports show your legitimate mail passing, move to p=quarantine and then p=reject.

3 more findings

  • Note: fo= has no effect without ruf=

  • Pass: 1 aggregate report address(es) configured

  • Pass: The DMARC record is valid

Open the full DMARC checker

MX lookup

Pass

This domain receives mail (Google Workspace)

Mail servers

  • 1aspmx.l.google.comresolves
  • 5alt1.aspmx.l.google.comresolves
  • 5alt2.aspmx.l.google.comresolves

  • Note: Mail is handled by Google Workspace

1 more finding

  • Pass: 3 of 3 mail servers resolve

Open the full MX lookup

DKIM checker

Pass

RSA key, 2048 bits

TXT google._domainkey.northwind.example

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7on…

  • Note: This does not prove that your mail is signed

1 more finding

  • Pass: Valid 2048-bit RSA key

Open the full DKIM checker

Illustrative data for a made-up domain. Check your own domain above to replace it with a live report.

A tool for every part of email delivery

Authentication records, mail servers and transport security are checked live. Header analysis and address validation run entirely in your browser, so what you paste never leaves it.

Authentication

Delivery and transport

Private, in your browser

From domain to fix in three steps

No account, no waiting for a report by email. The answer is on the page in a second or two.

  1. 1

    Enter a domain

    Paste a domain, a URL or an email address. We take the domain from it and normalize international names.

  2. 2

    We query DNS live

    Our resolvers fetch every record, follow includes, redirects and CNAMEs, and count lookups the way receiving servers do.

  3. 3

    Read the findings, copy the fix

    Problems come first, each with the reason, the standard and the change to make. Copy a summary for your provider or your team.

Keep it working

A record that is right today can be changed tomorrow by a provider migration, a DNS cleanup or a typo. Two ways to notice in time:

Monitoring with a free account

  • Daily checks of SPF, DKIM, DMARC, MX, MTA-STS and TLS-RPT for domains you have verified.
  • An email when something changes, with the record before and after — at the level you choose, and never the same alert twice in a week.
  • A history of every change, an optional weekly summary, and saved DMARC reports with a 90-day trend.
Example entry from the history

CriticalDMARC record changed

Before
v=DMARC1; p=reject; rua=mailto:dmarc@example.com
After
v=DMARC1; p=none; rua=mailto:dmarc@example.com

Set up monitoring

The same checks in your code

Every check is a JSON endpoint. Run them from a deployment pipeline after DNS changes, or from your own monitoring.

A real response, shortened
$ curl -s "https://correct.email/api/v1/spf?domain=example.com"
{
  "check": "spf",
  "result": {
    "status": "pass",
    "record": "v=spf1 ip4:35.190.247.0/24 -all",
    "lookups": {
      "count": 0,
      "limit": 10
    },
    "findings": [
      {
        "code": "spf.all_fail",
        "severity": "ok"
      },
      {
        "code": "spf.lookups_ok",
        "severity": "ok"
      }
    ]
  }
}

API documentation

Guides

Practical explanations with real DNS examples and references to the standards.

All guides
Email authenticationHow to configure DMARC correctlyA step-by-step DMARC rollout from p=none to p=reject, updated for RFC 9989: reports, alignment, subdomain policies and the mistakes to avoid.Read the guide6 min read