They are the three DNS records that stop your domain being impersonated in email. SPF lists the servers allowed to send mail as you; DKIM publishes a key that lets receivers verify a message really came from you and was not altered; DMARC tells receiving servers what to do when a message fails the first two. All three are public DNS TXT records — no software to install, and checking them sends no email.
v=spf1, naming the servers that may send mail as you.default, google, zmail, s1, selector1 and selector2 — and a key at any one of them counts as present. A negative means no key there, not proof you have none._dmarc. on your domain beginning v=DMARC1, carrying your policy for failed mail.Lookups strip a leading www., so www.example.com and example.com give the same answer.
In our corpus of 2,528 scanned small-business domains, 53% had SPF but only 35% had DMARC. That gap matters because SPF and DKIM without DMARC are checks with no instruction attached — DMARC is the record that tells receiving servers to actually quarantine or reject mail that fails. Providers often set up SPF and DKIM automatically; DMARC usually has to be added on purpose, which is why it is the one to check first.
Because all three live in public DNS, our free scan resolves them through a public resolver — your server is never touched and no email is sent. The result is part of every scan report, alongside the AI-visibility checks, because the same domain that serves your website carries your email's reputation.
For meaningful protection, yes — SPF and DKIM authenticate, DMARC enforces. In our 2,528-domain corpus, the enforcement record is the missing one: 53% had SPF but only 35% had DMARC.
SPF and DKIM describe your existing senders, so set correctly they change nothing. DMARC lets you start with a monitoring policy before an enforcing one, so you can see what would fail before anything is rejected.
The name under which a signing key is published in DNS. Our scan checks six common ones — default, google, zmail, s1, selector1, selector2 — and a key at any of them counts as present; a miss means no key at those names, not proof you have none anywhere.
No. The records are already public DNS by design — that is how receiving mail servers use them. The scan resolves them through a public resolver and sends no mail.
Where does your site stand? The scan is free, takes about 60 seconds, and needs no account. It fetches your homepage exactly the way GPTBot, ClaudeBot and PerplexityBot do and tells you what they receive.