How to Test Email Authentication

TL;DR: The fastest way to test SPF, DKIM and DMARC on your domain is to run a free Kalenfy scan — enter your domain, get a pass/fail result and letter grade in under 10 seconds. If you want to verify manually, the three methods below work without any paid tool.

Method 1 — Read the raw email headers (Gmail)

Every email you receive contains an Authentication-Results header that shows SPF, DKIM and DMARC pass/fail for that specific message. It is the most authoritative test because it reflects what the receiving server actually checked.

1. Send an email from the domain you want to test to a Gmail address.
2. Open the message in Gmail → click the three-dot menu ⋮ → Show original.
3. In the raw headers, find Authentication-Results or look at the summary at the top of the "Original Message" page.
4. You want to see: spf=pass, dkim=pass, dmarc=pass.

Method 2 — Query DNS directly with dig (command line)

You can check SPF, DKIM and DMARC records exist in DNS without sending any email. This tells you the records are published — it does not verify they are correct, but it catches missing records immediately.

# SPF (TXT record on root domain)
dig TXT yourdomain.com +short

# DMARC
dig TXT _dmarc.yourdomain.com +short

# DKIM — replace "google" with your selector (visible in your ESP settings)
dig TXT google._domainkey.yourdomain.com +short

On Windows, use nslookup -type=TXT yourdomain.com in Command Prompt instead.

Expected outputs:

• SPF: a string starting with v=spf1
• DMARC: a string starting with v=DMARC1
• DKIM: a long string starting with v=DKIM1; k=rsa; p= followed by the public key

If any query returns no result, that record does not exist on your domain.

Method 3 — Free live scan (fastest, no setup)

The Kalenfy scanner checks all three records simultaneously — SPF, DKIM and DMARC — against your live DNS and gives you a single A+→F grade with plain-English explanations of any failures. It also checks DNSSEC, CAA, MTA-STS, security headers and more in the same scan.

Enter your domain → get your grade in under 10 seconds → download a PDF report.

What to do when a check fails

FAQ

Do I need to send a real email to test DKIM?

To verify DKIM is actually signing messages, yes — you need to send a real email and check the headers. The DNS query (Method 2) only confirms the public key record exists, not that your mail server is applying the signature. The Kalenfy scan can also verify the DKIM record is well-formed and resolves correctly.

My SPF passes but DMARC still fails — why?

DMARC requires alignment: the domain in SPF's Return-Path (envelope sender) must match the From domain. If you use a third-party ESP with its own Return-Path domain, SPF can pass on the ESP's domain but DMARC still fails because the From domain doesn't align. The fix is to enable DKIM, which aligns on the signing domain — see DMARC alignment explained.

How often should I test email authentication?

Test any time you add a new email provider or tool, change your DNS, or notice deliverability problems. It is also good practice to run a scan quarterly — records can break silently when a third-party ESP rotates keys or changes their infrastructure.

Gmail shows dkim=pass but my ESP dashboard says DKIM is off — which is right?

Trust the Gmail raw headers. The ESP dashboard might show "DKIM disabled" for their custom domain signing (branded), but if the system DKIM is still active it would show pass in headers. Check the d= tag in the DKIM result to see which domain signed the message — it should match your From domain for DMARC to pass.