Email authentication: sitehostingfinder.com
Can someone send email pretending to be your domain? Check all three records at once, see a score, and get the exact fix for anything missing or broken.
Try: google.com · proton.me · github.com
Well protected sitehostingfinder.com
No mail servers (MX records) found. Checked Thu, 12 Nov 2026 14:47:59 UTC.
- This domain has no mail servers and is locked down correctly: SPF "-all" and DMARC "p=reject" stop anyone sending email as it.
DMARC p=reject
Edit in DMARC generator →Found at _dmarc.sitehostingfinder.com
v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s;
| Tag | Value | Meaning |
|---|---|---|
| v | DMARC1 | Version |
| p | reject | Policy for this domain |
| sp | reject | Policy for subdomains |
| adkim | s | DKIM alignment (r = relaxed, s = strict) |
| aspf | s | SPF alignment (r = relaxed, s = strict) |
- No "rua" reporting address, so you get no reports on who sends email as your domain. Add rua=mailto:you@yourdomain.
- Strict alignment (adkim/aspf=s) is set: mail from subdomains or other domains you use won't align. Fine if intended.
DKIM not found
| Selector | Usually | Key | Status |
|---|---|---|---|
| Google Workspace | revoked | revoked | |
| selector1 | Microsoft 365 | revoked | revoked |
| selector2 | Microsoft 365 | revoked | revoked |
| default | cPanel hosting / Namecheap Private Email | revoked | revoked |
| 20230601 | Gmail / Google (date selector) | revoked | revoked |
| 20221208 | Gmail / Google (date selector) | revoked | revoked |
| 20210112 | Gmail / Google (date selector) | revoked | revoked |
| 20161025 | Gmail / Google (date selector) | revoked | revoked |
| k1 | Mailchimp | revoked | revoked |
| k2 | Mailchimp | revoked | revoked |
| k3 | Mailchimp | revoked | revoked |
| s1 | SendGrid | revoked | revoked |
| s2 | SendGrid | revoked | revoked |
| protonmail | Proton Mail | revoked | revoked |
| protonmail2 | Proton Mail | revoked | revoked |
| protonmail3 | Proton Mail | revoked | revoked |
| fm1 | Fastmail | revoked | revoked |
| fm2 | Fastmail | revoked | revoked |
| fm3 | Fastmail | revoked | revoked |
| sig1 | iCloud Mail | revoked | revoked |
| zmail | Zoho Mail | revoked | revoked |
| zoho | Zoho Mail | revoked | revoked |
| mandrill | Mailchimp Transactional | revoked | revoked |
| mailjet | Mailjet | revoked | revoked |
| resend | Resend | revoked | revoked |
| brevo1 | Brevo | revoked | revoked |
| brevo2 | Brevo | revoked | revoked |
| revoked | revoked | ||
| dkim | revoked | revoked | |
| smtp | revoked | revoked | |
| mx | revoked | revoked | |
| revoked | revoked | ||
| key1 | revoked | revoked | |
| x | revoked | revoked |
- google: Empty key (p=): this selector has been revoked and no longer signs mail.
- selector1: Empty key (p=): this selector has been revoked and no longer signs mail.
- selector2: Empty key (p=): this selector has been revoked and no longer signs mail.
- default: Empty key (p=): this selector has been revoked and no longer signs mail.
- 20230601: Empty key (p=): this selector has been revoked and no longer signs mail.
- 20221208: Empty key (p=): this selector has been revoked and no longer signs mail.
- 20210112: Empty key (p=): this selector has been revoked and no longer signs mail.
- 20161025: Empty key (p=): this selector has been revoked and no longer signs mail.
- k1: Empty key (p=): this selector has been revoked and no longer signs mail.
- k2: Empty key (p=): this selector has been revoked and no longer signs mail.
- k3: Empty key (p=): this selector has been revoked and no longer signs mail.
- s1: Empty key (p=): this selector has been revoked and no longer signs mail.
- s2: Empty key (p=): this selector has been revoked and no longer signs mail.
- protonmail: Empty key (p=): this selector has been revoked and no longer signs mail.
- protonmail2: Empty key (p=): this selector has been revoked and no longer signs mail.
- protonmail3: Empty key (p=): this selector has been revoked and no longer signs mail.
- fm1: Empty key (p=): this selector has been revoked and no longer signs mail.
- fm2: Empty key (p=): this selector has been revoked and no longer signs mail.
- fm3: Empty key (p=): this selector has been revoked and no longer signs mail.
- sig1: Empty key (p=): this selector has been revoked and no longer signs mail.
- zmail: Empty key (p=): this selector has been revoked and no longer signs mail.
- zoho: Empty key (p=): this selector has been revoked and no longer signs mail.
- mandrill: Empty key (p=): this selector has been revoked and no longer signs mail.
- mailjet: Empty key (p=): this selector has been revoked and no longer signs mail.
- resend: Empty key (p=): this selector has been revoked and no longer signs mail.
- brevo1: Empty key (p=): this selector has been revoked and no longer signs mail.
- brevo2: Empty key (p=): this selector has been revoked and no longer signs mail.
- mail: Empty key (p=): this selector has been revoked and no longer signs mail.
- dkim: Empty key (p=): this selector has been revoked and no longer signs mail.
- smtp: Empty key (p=): this selector has been revoked and no longer signs mail.
- mx: Empty key (p=): this selector has been revoked and no longer signs mail.
- email: Empty key (p=): this selector has been revoked and no longer signs mail.
- key1: Empty key (p=): this selector has been revoked and no longer signs mail.
- x: Empty key (p=): this selector has been revoked and no longer signs mail.
Extras
- MTA-STS
- off Forces other servers to use encrypted TLS when delivering to you. Optional.
- TLS-RPT
- off Sends you reports when encrypted delivery fails. Optional.
- BIMI
- off Shows your logo in Gmail and Yahoo. Needs DMARC at quarantine or reject first.
SPF, DKIM and DMARC in plain English
| Record | What it does | Where it lives |
|---|---|---|
| SPF | Lists the servers allowed to send email as your domain. | yourdomain.com (TXT) |
| DKIM | A signature on every email, proving it wasn't changed and really came from you. | selector._domainkey.yourdomain.com |
| DMARC | Tells receivers what to do when SPF and DKIM fail (nothing, spam folder or reject) and sends you reports. | _dmarc.yourdomain.com |
You need all three. SPF and DKIM prove who sent a message; DMARC is the rule that makes the proof matter. Without DMARC, a spoofed email that fails SPF can still land in the inbox.
Who requires this
Gmail and Yahoo have required SPF, DKIM and a DMARC record from anyone sending 5,000+ emails a day to their users since February 2024, and Outlook.com followed in 2025. Smaller senders aren't blocked outright, but mail without them is far more likely to land in spam. If you send invoices, password resets or a newsletter from your domain, set them up.
The SPF 10-lookup limit
Every include, a, mx, ptr, exists and redirect costs one DNS lookup, and includes inside includes count too. Past 10, SPF fails for every email. It's the most common SPF error we see, usually after adding a newsletter tool, a CRM and a help desk on top of the inbox provider. The checker counts the whole tree for you.
How to find your DKIM selector
DKIM keys live at a name you can't guess: selector._domainkey.yourdomain.com. We try the 34 selectors the big providers use. If yours isn't found, send an email from your domain to a different mailbox (a personal Gmail works), open it there and choose Show original. Gmail lists SPF, DKIM and DMARC results at the top. If DKIM says PASS, copy the value after s= in the DKIM-Signature header and enter it in the selector box. If there's no DKIM line or header at all, DKIM isn't turned on: enable it in your email provider's dashboard, which gives you the record to add.
Don't check a copy in your own Sent folder: when Gmail sends through another provider's server ("Send mail as"), the signature is added after Gmail keeps its copy, so the Sent copy never shows it.
The safe order to fix things
- Publish one SPF record listing every service that sends as you (SPF generator).
- Turn on DKIM in each of those services (they give you the record).
- Publish DMARC with
p=noneand a report address (DMARC generator). - After 2-4 weeks of clean reports, move to
p=quarantine, thenp=reject.
FAQ
How do I check my SPF, DKIM and DMARC records?
Enter your domain above. The checker reads all three records from public DNS, follows every SPF include, tries the common DKIM selectors, and gives a score out of 100 with a fix for each problem.
What is a good email authentication score?
Above 85 means SPF is valid, DKIM is signing with a strong key and DMARC is enforcing (quarantine or reject). Between 55 and 85 usually means DMARC is still at p=none or DKIM wasn't found. Below 55, your domain is easy to spoof.
Why does it say DKIM not found when I have DKIM?
DKIM keys sit at a selector name chosen by your email service. We try the common ones; if yours uses a custom selector, send an email to a different mailbox, open "Show original" there, and copy the s= value from the DKIM-Signature header. If the received email has no DKIM-Signature at all, DKIM isn't enabled yet.
Can I have two SPF records?
No. A domain must have exactly one SPF record. Two records make SPF fail for all your email. Merge them into one record with every include; the SPF generator does this for you.
Is p=none enough for DMARC?
It meets the Gmail and Yahoo minimum and gets you reports, but it doesn't stop spoofing. Use it for a few weeks to confirm your real senders pass, then move to quarantine and reject.
Does a domain that doesn't send email need these records?
Yes, it's the easiest domain to spoof. Publish "v=spf1 -all" and "v=DMARC1; p=reject" so receivers reject anything claiming to come from it.
CHANGING HOSTS?
DNS is where most migrations go wrong. Follow the hosting switch checklist, lower your TTL a day before, and use the propagation checker after the switch. Comparing new hosts? See real renewal prices.