Free email authentication checkers

The short answer

Four records decide whether a mailbox provider believes your mail is really yours. Each one of these checks a single record and tells you plainly what is wrong with it.

They run properly rather than superficially. The SPF check follows every include to count lookups the way a receiver does, the DKIM check finds your key without you knowing the selector, and the BIMI check downloads the logo and inspects the file.

No account, no email capture, nothing stored. They are DNS lookups, so they cost us nothing to run.

The four checks, in the order worth doing them

SPF
SPF record checker

Counts DNS lookups across the whole include tree, against the limit of 10 where records silently die.

Run it →
DKIM
DKIM record checker

Probes 18 common provider selectors, so you get an answer without digging through message headers first.

Run it →
DMARC
DMARC record checker

Reads the policy, the reporting address and the percentage, and says whether the record protects you or only watches.

Run it →
BIMI
BIMI record checker

Fetches the logo, validates it against the SVG Tiny PS profile, and checks the DMARC policy underneath.

Run it →

How the four fit together

SPF lists the servers allowed to send as you. DKIM signs each message so a receiver can prove it was authorised by your domain and not altered in transit. Neither says what should happen when the check fails, and neither tells you it happened.

DMARC supplies both halves. It sets the policy for failures and asks receivers to report on everything claiming to be you, which is the only visibility you will ever get into who is spoofing your domain. It needs SPF or DKIM to be aligned with your From address first, so it is third rather than first.

BIMI is the one that shows a logo, and it only works on a domain already at DMARC enforcement. Treat it as the receipt for the other three.

Why an outbound company built these

Because a broken record is the cheapest possible reason for good outreach to fail, and it is invisible until it has already cost you. A domain sends for years on a marginal setup and nothing looks wrong. Point real volume at it and the same configuration starts costing you the inbox.

Wisemation sends from your own Gmail or Outlook account rather than a shared pool, so your domain reputation is yours. That makes these four records your problem rather than a vendor problem, which is a better trade and a real responsibility.

Common questions

Which of these should I fix first?

SPF and DKIM, in either order, because DMARC cannot pass anything until at least one of them is aligned. Then DMARC at p=none to start the reports, then enforcement once you recognise every sender in them. BIMI last, if at all.

Do I need all four?

You need SPF, DKIM and DMARC. BIMI is optional and only affects how your mail looks once it has already arrived, so it is a finish line rather than a fix.

Do these cost anything, or need an account?

No to both. They are DNS lookups and they cost us nothing, so there is no reason to put a form in front of them. Nothing you check is stored.

Will fixing these get my cold email into the inbox?

It removes the reason to reject you outright, which is necessary and not sufficient. Authentication decides whether you are trusted to be who you say you are. Volume, list quality and what you actually wrote decide the rest.

Or see how the lead generation tools compare and what Wisemation costs.

Ten leads, on your real market

Describe who you sell to in a sentence. Wisemation finds them, researches each one, writes the emails and the follow-ups, and sends from your own inbox. You approve everything first.

Try it free →