For the complete site index, see llms.txt. Docs index: llms-docs.txt. Marketing corpus: llms-full.txt. Docs corpus: llms-full-docs.txt. Prefer markdown URLs where available (append .md).. Product skill: skill.md. Pricing: pricing.md. Docs MCP: /docs/mcp. Site MCP: /mcp.

Free Email Authentication Tool

SPF, DKIM & DMARC Checker

Audit your sending domain's email authentication setup. Verify SPF mechanisms and lookup limits, test DKIM selector cryptographic keys, inspect DMARC policy alignment, and check MX server reachability.

Try Presets:
RFC 7208 (SPF) · RFC 6376 (DKIM) · RFC 7489 (DMARC)

Why sender authentication matters.

Protect your domain reputation and ensure your transactional and marketing emails land directly in inboxes instead of spam folders.

Meet 2024+ Gmail & Yahoo Requirements

Google and Yahoo strictly enforce SPF, DKIM, and DMARC for custom domains sending to personal inboxes. Missing or unaligned records lead directly to spam filtering.

Prevent Phishing & Domain Spoofing

A strict DMARC policy (p=reject) instructs global recipient mailboxes to discard fraudulent emails pretending to originate from your brand.

Eliminate SPF PermErrors

RFC 7208 imposes a strict 10 DNS lookup limit on SPF records. Exceeding 10 lookups triggers a permanent failure and drops inbox rates.

Verify Cryptographic Signatures

Ensure your DKIM public key is published with strong 2048-bit RSA encryption and properly matches your sending ESP headers.

Audit authentication records programmatically.

Integrate automated SPF, DKIM, and DMARC verification into your onboarding flow with our zero-setup public API.

1

Install the Node.js package

npm install reloop-email
2

Audit email authentication records with Node.js

check_auth.ts
1import Reloop from 'reloop-email';
2

3const reloop = new Reloop(process.env.RELOOP_API_KEY);
4

5const report = await reloop.tools.authChecker({
6  domain: 'stripe.com',
7  selector: 's1', // Optional DKIM selector
8});
9

10console.log(`Score: ${report.score}/100 (Grade: ${report.grade})`);
11console.log(`DMARC Policy: p=${report.dmarc.policy}`);
12console.log(`SPF: ${report.spf.rawRecord}`);
13console.log(`DKIM (${report.dkim.selector}): ${report.dkim.keyLength}-bit RSA`);
3

Inspect JSON authentication report (200 OK)

response.json
1{
2  "domain": "stripe.com",
3  "resolvedAt": "2026-08-30T12:00:00.000Z",
4  "responseTimeMs": 48,
5  "score": 100,
6  "grade": "A+",
7  "verdict": "fully_aligned",
8  "verdictLabel": "Fully Protected & Aligned",
9  "spf": {
10    "status": "pass",
11    "published": true,
12    "rawRecord": "v=spf1 include:_spf.google.com ~all",
13    "qualifier": "~all",
14    "lookupCount": 1,
15    "mechanisms": ["include:_spf.google.com", "~all"],
16    "includes": ["_spf.google.com"],
17    "ip4": [],
18    "ip6": [],
19    "warnings": []
20  },
21  "dkim": {
22    "status": "pass",
23    "published": true,
24    "selector": "s1",
25    "rawRecord": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...",
26    "publicKey": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8...",
27    "keyLength": 2048,
28    "algorithm": "rsa",
29    "testedSelectors": ["s1", "google", "default"],
30    "warnings": []
31  },
32  "dmarc": {
33    "status": "pass",
34    "published": true,
35    "rawRecord": "v=DMARC1; p=reject; rua=mailto:dmarc-reports@stripe.com; pct=100; aspf=s",
36    "policy": "reject",
37    "subdomainPolicy": "reject",
38    "percentage": 100,
39    "rua": ["mailto:dmarc-reports@stripe.com"],
40    "ruf": [],
41    "dkimAlignment": "relaxed (r)",
42    "spfAlignment": "strict (s)",
43    "warnings": []
44  },
45  "mx": {
46    "status": "pass",
47    "published": true,
48    "provider": "Google Workspace",
49    "records": [
50      { "exchange": "aspmx.l.google.com", "priority": 1 },
51      { "exchange": "alt1.aspmx.l.google.com", "priority": 5 }
52    ],
53    "warnings": []
54  },
55  "bimi": {
56    "status": "pass",
57    "published": true,
58    "rawRecord": "v=BIMI1; l=https://stripe.com/bimi.svg",
59    "svgUrl": "https://stripe.com/bimi.svg",
60    "vmcUrl": null
61  },
62  "mtaSts": {
63    "status": "pass",
64    "published": true,
65    "rawRecord": "v=STSv1; id=20240101",
66    "mode": "enforce"
67  },
68  "diagnostics": [
69    {
70      "id": "dmarc-record",
71      "name": "DMARC Policy Enforcement",
72      "category": "dmarc",
73      "status": "pass",
74      "message": "DMARC published with strict policy 'p=reject' and aggregate reporting",
75      "details": "v=DMARC1; p=reject; rua=mailto:dmarc-reports@stripe.com"
76    },
77    {
78      "id": "spf-record",
79      "name": "Sender Policy Framework (SPF)",
80      "category": "spf",
81      "status": "pass",
82      "message": "SPF published with 1/10 DNS lookups and '~all' qualifier",
83      "details": "v=spf1 include:_spf.google.com ~all"
84    },
85    {
86      "id": "dkim-record",
87      "name": "DKIM Signature & Key",
88      "category": "dkim",
89      "status": "pass",
90      "message": "Found 2048-bit RSA key for selector 's1'",
91      "details": "s1._domainkey.stripe.com"
92    },
93    {
94      "id": "mx-records",
95      "name": "Mail Routing (MX)",
96      "category": "mx",
97      "status": "pass",
98      "message": "Configured with 2 mail exchange server(s) via Google Workspace"
99    }
100  ]
101}

Frequently asked questions.

Everything you need to know about SPF lookup limits, DKIM selectors, DMARC policies, and mail deliverability standards.

Ship your first email in minutes

Open-source, deliverability-focused, and yours to self-host or run on Reloop Cloud. No lock-in, no rewrite later.

Get started freeDocumentation
Reloop