About this tool
Enter a domain to see whether its mail authentication is actually configured correctly: MX records, the full SPF record with every mechanism explained, DMARC policy translated into what it really does, and DKIM keys found by probing common selectors.
The centrepiece is the SPF lookup count. RFC 7208 allows a maximum of ten DNS lookups when evaluating SPF, and include: chains nest — so a record that looks fine can quietly exceed the limit, at which point receivers return permerror and your SPF stops protecting anything. This tool follows every include and redirect and shows a running count, naming the exact mechanism that crosses the line. It also flags the common illusions: p=none means DMARC is monitoring and blocking nothing, +all accepts mail from anywhere, and an empty DKIM p= tag means the key has been revoked.