Email Security Checker
SPF, DKIM, DMARC and friends for any domain, with a grade and plain-English fixes.
Try:
Records are read from public DNS. DKIM keys are looked up on 32 common selectors; if your provider uses another one (it's in the s= tag of a DKIM-Signature header), enter it above. Limited to 30 checks per 10 minutes.
About this tool
SPF
Lists the servers allowed to send email for your domain. End it with ~all or -all, keep it to one record, and stay under 10 DNS lookups or receivers will treat it as broken.
DKIM
Your mail provider signs each message with a key published in DNS, proving the message wasn't altered and really came from your domain.
DMARC
Tells receivers what to do when SPF and DKIM fail, and where to send reports. Start with p=none and a rua= address, check the reports, then move to quarantine or reject to stop spoofing.