Add an email record checker to your site.

Yes. Pick SPF, DMARC or DKIM and a theme above, and copy the snippet: an iframe with the checker and a link to the full tool. It's free, needs no account or key, and your visitors' checks count against their own limit, not yours. The snippet loads lazily and sets no cookies on your page.

They're the three DNS records that prove mail really comes from your domain. SPF lists the servers allowed to send it. DKIM adds a signature to each message that receivers check against a public key in your DNS. DMARC tells receivers what to do when a message passes neither, and sends you reports. Gmail, Yahoo and Microsoft expect all three from anyone sending in bulk.

Every include, a, mx, ptr, exists and redirect makes the receiver look something up in DNS, and includes can contain more includes. The SPF standard caps the total at 10 to keep checks fast. Over 10, receivers return a permanent error and SPF fails for every message. The SPF checker follows every include and counts the total for you.

Either is fine. ~all (softfail) asks receivers to accept but mark mail from unlisted servers; -all (fail) asks them to reject it. With DMARC in place, receivers act on DMARC's policy either way, so ~all is the common, safe choice. Never use +all, which lets every server on the internet pass.

It's the right place to start: receivers send you reports but still deliver mail that fails, so nothing breaks while you check that your own senders pass. It doesn't protect your domain from spoofing, though. Once reports look clean, move to p=quarantine, then p=reject.

It's optional, but without it you get no reports, so you can't see who sends mail as your domain or whether your own services pass. Add rua=mailto: with an address you read, or one from a DMARC report service.

A selector is the name a DKIM key is published under, at selector._domainkey.yourdomain. Mail providers pick it, for example google for Google Workspace and selector1 for Microsoft 365. The DKIM checker tries 30 common ones. To find yours, open the headers of a message you sent and look for s= in the DKIM-Signature line.

2048-bit RSA is the current recommendation. 1024-bit keys still work but are considered weak, and receivers ignore keys shorter than 1024 bits, so DKIM fails. Your mail provider can create a new key; publish it under a new selector, switch signing over, then remove the old one.

Without an account, 30 SPF, 60 DMARC and 30 DKIM checks an hour per IP address. With a free account, the REST API and MCP server allow 500 SPF, 1,000 DMARC and 500 DKIM checks a day.

Yes. The Lemon Domains MCP server has check_spf, check_dmarc and check_dkim tools, the REST API serves them at /api/v1/spf, /api/v1/dmarc and /api/v1/dkim, and the lemon CLI runs lemon spf example.com. Agents without an account can fetch lemon.domains/tools/spf-checker/example.com.md, or .json.