Email is the only protocol where “set it and forget it” quietly becomes “set it and get spoofed.” The Gizmo 421 Email Auth Lookup checks the three DNS records that decide whether your mail gets delivered: SPF, DKIM, and DMARC. Type a domain, get a verdict on all three.
What the three records do
SPF (Sender Policy Framework) lists the servers allowed to send mail for your domain. DKIM cryptographically signs each message so receivers can verify it wasn’t tampered with. DMARC tells receiving servers what to do when SPF or DKIM fail — and where to send you reports about it. All three live in plain DNS TXT records, which is exactly what this tool reads: queries run from your browser to Google’s public DNS-over-HTTPS resolver. Nothing is sent to us.
How to read the verdicts
A pass means the record exists and is well-formed — for SPF that includes the DNS lookup budget (10 max, a rule many oversized records break) and the ending qualifier, where -all is strict and ~all is a soft fail. For DKIM, the tool tries the selector you provide plus ten common ones; if your mail platform uses an exotic selector, drop it in the optional field. For DMARC, you’ll see the policy (none = monitor only, quarantine = spam folder, reject = hard block) and the reporting address.
SPF vs DKIM vs DMARC at a glance
People mix these up constantly because they all “secure email,” but they answer three different questions. SPF: which servers may send for this domain? DKIM: was this exact message tampered with in transit? DMARC: what should happen when the first two fail — and who gets told? SPF and DKIM each pass or fail independently; DMARC is the policy layer that reads both. You need all three because a message can pass SPF for a domain you don’t own (that’s alignment, and it’s why DMARC exists) and DKIM can pass while SPF fails. Belt, suspenders, and a rulebook.
How to fix each verdict
No SPF: add one TXT record on your apex domain: v=spf1 include:yourmailplatform.com -all. Your provider documents the exact include value. Start with ~all if you’re nervous, but -all is the goal. Never add a second SPF record — edit the existing one.
No DKIM: your mail platform generates a key pair and gives you a TXT record to publish at selector._domainkey.yourdomain.com. Copy it exactly — DKIM records get split into multiple quoted strings for length, and hand-copying them wrong is the #1 DKIM failure.
No DMARC: publish v=DMARC1; p=none; rua=mailto:you@yourdomain.com first. That’s monitor-only: nothing changes, but the reports show you everything sending as your domain. After a week or two of clean reports, move to p=quarantine, then p=reject when you trust it.
The SPF lookup budget, with an example
Every include: in your SPF costs a DNS lookup, and the RFC caps evaluation at 10. The trap: each include’s own record can include more. A record with include:zohomail.com include:one.zoho.com seems like 2 lookups, but each of those records pulls in further includes, and your budget drains faster than it looks. This tool counts the real total and warns before you’re over. If you’re over budget, remove includes for services you no longer use — that abandoned 2019 SaaS integration in your SPF is exactly the kind of thing that breaks silently. Verify the cut with the DNS Lookup tool (TXT on your domain) after the record propagates.
Common questions
Why do I get a pass but mail still lands in spam? These records are necessary, not sufficient — server reputation, content filtering, and list hygiene all play a role. Does checking a domain put it on a list? No — the lookup is an ordinary public DNS query, same as typing it into any resolver. Someone’s records look broken — should I tell them? Forward the verdicts; email admins usually appreciate it. I have SPF and DKIM — do I still need DMARC? Yes — without it, receivers fall back to guesswork and you get zero visibility into spoofing. How long until changes take effect? DNS changes propagate per your TTL, usually minutes; re-run the check after. Why does DMARC say p=none? That’s the monitor-only training-wheels policy — the right start, but a domain that lives on p=none forever has a lock on the door and never throws it.