The email command parses SPF, DMARC, DKIM and MX, grades the domain, and lists issues, with a --json mode for scripting.
# full email auth report, human readable
python cli.py emailexample.com# include a DKIM selector lookup
python cli.py emailexample.com--selectorgoogle# structured JSON (spf, dmarc, dkim, mx, score, grade, issues)
python cli.py emailexample.com--json
THE BIG DIFFERENCE
Run email checks from inside your AI
This AI-native tool speaks the Model Context Protocol (MCP) and ships a REST API. Connect it once, then just ask your assistant whether a domain's SPF, DMARC and DKIM are set up to block spoofing.
An email authentication checker reads the DNS records that prove your domain's email is genuine and shows whether they are set up correctly. This tool analyzes SPF, DMARC and DKIM, lists your MX mail servers, then grades the domain from A to F and explains every issue in plain English so you can harden it against spoofing.
What SPF, DMARC and DKIM do
SPF (Sender Policy Framework): a TXT record that lists the servers allowed to send mail for your domain. The final all mechanism sets how strict it is, where -all is a hard fail and ~all is a soft fail.
DKIM (DomainKeys Identified Mail): a cryptographic signature published at a selector, such as google._domainkey.example.com, that proves a message was not altered in transit.
DMARC (Domain-based Message Authentication): a policy record that ties SPF and DKIM together, tells receivers what to do with mail that fails (none, quarantine or reject), and can send aggregate reports to a rua address.
MX (Mail Exchange): the servers that receive email for your domain, listed in priority order.
How to read the grade
The checker scores each layer and combines them into a single grade from 0 to 100:
A: SPF ends in a hard or soft fail, DKIM is present, and DMARC is at quarantine or reject. Spoofing is well defended.
B and C: the basics exist but the policy is weak, for example DMARC set to none or SPF ending in +all. Attackers can still slip through.
D and F: one or more records are missing, so your domain can be forged in phishing with little effort. Fix these first.
Why email auth matters for spoofing
Without SPF, DKIM and a strict DMARC policy, anyone can send mail that appears to come from your domain, which fuels phishing, invoice fraud and brand damage, and quietly hurts your deliverability at Gmail and Outlook. A strong setup, DMARC at reject backed by aligned SPF and DKIM, tells the world's mailbox providers to drop forgeries before they reach an inbox.
How to run the check
Type the domain (for example github.com) into the box above.
Optionally add your mail provider's DKIM selector, such as google for Google Workspace.
Select Check. The SPF, DMARC, DKIM and MX results and the grade appear in a few seconds.
Work through the issues list to close every gap, or use the CLI, API and MCP for scripting and AI assistants.
Frequently asked questions
What is an email authentication checker?
An email authentication checker analyzes the DNS records that prove your domain's email is genuine: SPF, DMARC and DKIM, plus the MX records that receive your mail. This tool reads those records, grades them from A to F, and lists plain-English issues so you can stop spammers from spoofing your domain.
What are SPF, DMARC and DKIM?
SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature that proves a message was not tampered with. DMARC ties SPF and DKIM together, tells receivers what to do with mail that fails, and can send you reports. Together they stop attackers from forging your domain in phishing and spam.
Is the Email Auth Checker free and open source?
Yes. It is completely free and open source under the MIT license, part of WebToolsHub by Konko Maji. It reads public DNS records over HTTPS, so there is no signup and no data is stored.
How do I check a DKIM record?
DKIM records live at a selector, such as google._domainkey.example.com. Because selectors are chosen by each provider they cannot be guessed reliably, so enter the selector your mail provider uses (for example google, k1 or s1) in the optional field and the checker will look it up.
Can I run an email auth check inside Claude, ChatGPT or Gemini?
Yes. It ships an MCP server and a REST API, so you can connect it to Claude, ChatGPT, Gemini, Kimi, Cursor and any MCP client, then ask your assistant to check a domain's SPF, DMARC and DKIM for you. See the connection guide.