h2check

SPF, DKIM and DMARC checker

Reads a domain's SPF, DMARC and DKIM records from Google Public DNS and Cloudflare over DNS-over-HTTPS and reports each one parsed, including the SPF lookup count, which gives a permanent error once it passes ten.

Checker offline. Follow the manual steps below, they give the same answer.

What it checks

  • The SPF record, whether there is exactly one, and its all qualifier: -all and ~all are reported as ok, ?all and a record with no all as a warning, +all or a bare all as a failure.
  • The SPF lookup count under RFC 7208 section 4.6.4. include and redirect are followed and their records read; a, mx, ptr and exists are counted and not resolved; terms after all are not counted; a redirect in a record that has all is ignored. The count is compared with the limit of ten.
  • Every record reached through include and redirect: a loop, a target with no SPF record, a target with two, and a syntax error or unknown mechanism are each a permanent error, and the row names where it happened.
  • The ptr mechanism anywhere in the tree, which RFC 7208 section 5.5 says not to use.
  • The DMARC record at _dmarc of the domain: more than one record means no policy applies; p, sp, pct, the adkim and aspf alignment modes, rua, ruf and fo, each read. p=none is reported as enforcing nothing, and a pct under 100 as applying the policy to part of the failing mail.
  • A DKIM key for a selector you supply, since no query can list a domain's selectors. A CNAME to a provider is followed and named. An empty p= is reported as a revoked key, an RSA key under 1024 bits as a failure and under 2048 as a warning (RFC 8301), and an Ed25519 key is checked for its 32 bytes (RFC 8463).
  • Whether the two resolvers returned the same SPF, DMARC and DKIM records.

What is not stored

This checker runs on a server, and the server is not deployed yet, so the form above is disabled. The manual steps on the procedures below return the same answer from your own machine, and they are what the checker automates.

Limits

  • Two public resolvers are asked, from the server this checker runs on. The records reached through include and redirect are read from one of them, and the walk stops after 20 DNS requests; a larger tree is reported with a lower bound and the names that were not read.
  • An include or redirect target built with a macro such as %{i} depends on the sender, which is not known here. It is counted as one lookup and not read, and the total becomes a lower bound.
  • The address lookups that each mx and ptr term adds are not checked.
  • DMARC is read at _dmarc of the domain only. When there is no record there, a receiver asks the organizational domain, found with the Public Suffix List; this checker does not load that list and does not guess a parent name.
  • Report addresses on another domain are not verified: the record that authorises them is not queried.
  • A DKIM selector has to be supplied. It is discoverable only from a message the domain sent. A wildcard record under _domainkey would look like a key here.
  • No message is fetched, sent or verified here. A key that is published and parses says nothing about whether the signatures made with it verify.

Put it on your own page

Link to it with the value filled in, and the checker runs as soon as the page opens.

<a href="https://h2check.org/tools/spf-dkim-dmarc/">SPF, DKIM and DMARC checker</a>