# Free email authentication checker for SPF, DKIM, DMARC, BIMI, and MX Check SPF, DKIM, DMARC, BIMI, MX, MTA-STS, and TLS-RPT sender authentication. [Home](https://www.mailslurp.com/)/[Tools](https://www.mailslurp.com/tools/) Free email auth checker Run a free email authentication checker to review SPF, DKIM, DMARC, BIMI, MX, MTA-STS, and TLS-RPT in one request. Use it as the fastest first-pass sender posture check before launch, migration, or incident escalation. Run a combined auth check ## Check the full sender-auth stack for a domain Enter the domain and optionally the active DKIM selector. The result summarizes health score, issue counts, and the status of each auth layer. Best fit ### Use this when multiple trust signals may have drifted This page is strongest when a team needs the fastest domain-wide answer before opening a deeper investigation into one specific DNS or auth layer. - Check the sender stack before major launches - Review auth drift after DNS or provider changes - Shorten incident triage when multiple checks are plausible Upgrade path ### Turn a one-shot posture check into a monitored workflow Manual combined checks are useful for fast answers. Ongoing domain monitoring is better when auth ownership spans multiple releases and teams. - Keep auth posture visible between launches - Route degraded or critical runs to domain owners - Move from spot checks to repeatable sender governance [Open domain monitoring](https://www.mailslurp.com/product/dmarc-spf-dkim-monitoring/) ## Key details Primary use ### Combined auth review Check the sender stack before you decide which single-record problem deserves the next investigation. Coverage ### 7 checks Review SPF, DKIM, DMARC, BIMI, MX, MTA-STS, and TLS-RPT together. Decision signal ### 1 health score Use one score and one status to decide whether rollout risk is acceptable. Best moment ### Pre-launch Most useful before migrations, campaign launches, and sender trust escalations. What this checks ## A combined auth checker should make the next step obvious The goal is to show whether the sender domain looks healthy overall and to point you toward the layer that deserves a deeper follow-up, not to drown you in unrelated record detail. SPF and DKIM Sender trust Validate authorization and signing before relying on them in production flows. DMARC and BIMI Policy and brand Review enforcement posture and brand signal readiness together. MX and transport Routing and TLS See whether mail-routing and transport security records also look aligned. Outcome Prioritized follow-up Use one health score and issue summary to decide which detailed checker to open next. Operational use ## Best used before launches, migrations, and sender incidents Checking SPF, DKIM and DMARC together answers a high-stakes question: is the sender domain ready, or already drifting? ### Pre-launch posture Use the combined check before important campaigns or product email releases so auth gaps are visible early. ### Post-migration validation Re-run after DNS edits or provider cutovers to confirm the sender stack still looks coherent from the outside. ### Incident triage Start here when the issue may sit in more than one auth layer and you need the highest-signal first answer. Triage order ## Use the combined checker first, then drill into the failing layer A domain authentication incident can start in DNS, policy, signing, routing, or transport. The combined result gives you the first verdict; the linked detail tools help you fix the specific layer without guessing. | If the combined check flags | Open next | What to confirm | | --------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------- | | Sender authorization | [SPF checker](https://www.mailslurp.com/tools/spf-checker/) | Only approved mail services can send for the domain. | | Message signing | [DKIM checker](https://www.mailslurp.com/tools/dkim-checker/) | The active selector resolves and matches the signing service. | | Policy or alignment | [DMARC checker](https://www.mailslurp.com/tools/dmarc-checker/) | DMARC policy, reports, and alignment match the rollout stage. | | Received-message evidence | [Email header analyzer](https://www.mailslurp.com/tools/email-header-analyzer/) | Authentication-Results confirms what receivers actually saw. | ## Related tools ### SPF checker Drill into SPF when the combined result suggests sender authorization is the problem. [Open tool](https://www.mailslurp.com/tools/spf-checker/) ### DKIM checker Open a selector-specific view when signing posture needs deeper review. [Open tool](https://www.mailslurp.com/tools/dkim-checker/) ### DMARC checker Inspect the live DMARC record when enforcement or reporting posture looks weak. [Open tool](https://www.mailslurp.com/tools/dmarc-checker/) ### DMARC report analyzer Move from DNS posture into aggregate report evidence when sender cleanup is the next job. [Open tool](https://www.mailslurp.com/tools/dmarc-report-analyzer/) ### Email header analyzer Inspect Authentication-Results on a real message when DNS posture and receiver verdicts disagree. [Open tool](https://www.mailslurp.com/tools/email-header-analyzer/) ## FAQ What does this email auth checker include? This email auth checker runs a combined SPF, DKIM, DMARC, BIMI, MX, MTA-STS, and TLS-RPT review so a team can see sender posture in one run instead of jumping across single-record tools. Why is this useful if individual checkers already exist? Single checkers are best for deep troubleshooting. This page is better when you need the first answer about overall domain posture before deciding which detail page deserves the next investigation step. Do I need a DKIM selector? No, but it helps. If you know the selector, include it so the DKIM result reflects the exact record you care about rather than a best-effort probe. When should teams use a combined auth checker? It is strongest before campaign launches, during sender migrations, and during deliverability incidents when multiple DNS trust signals may have drifted at once. Is this the same as an email authentication checker? Yes. Teams often call this an email authentication checker, domain authentication checker, or SPF DKIM DMARC checker. The goal is the same: confirm the sender domain has the DNS and policy records receivers expect before you rely on it for production sends.