Open source · MIT · Zero dependencies

Check your email authentication in one command.

Validates SPF, DKIM, DMARC, BIMI and MTA-STS for any domain. Counts recursive SPF lookups against the RFC limit, discovers DKIM selectors automatically, then grades the result A+ to F with fixes.

Get started View source

DNS EMAIL AUTHENTICATION REPORT Grade B 74/100

Domaintrustyourwebsite.com

✓ SPFv=spf1 include:_spf.google.com include:amazonses.com -all

Hard fail (-all) set · lookup count 4/10

✓ DKIMselector google found, 2048-bit key

⚠ DMARCpolicy=none, no aggregate reporting configured

✗ BIMIno record found

✗ MTA-STSno policy file at .well-known

FixMove DMARC from p=none to p=quarantine once reports look clean

Why it matters

Weak email auth is a deliverability and spoofing problem.

SPF, DKIM and DMARC are what stop attackers from sending mail as your domain, and what mailbox providers read before deciding whether your own mail lands in the inbox or the spam folder. A missing or misconfigured record quietly costs you both trust and delivery.

The catches are rarely obvious. SPF silently breaks once it needs more than ten recursive DNS lookups. DMARC left at p=none monitors but enforces nothing. This tool surfaces those exact failure modes instead of just confirming a record exists.

What it validates

Five standards, one pass.

SPF

Recursive lookup counting against the RFC 7208 limit of 10

DKIM

Auto-discovery across 18 common selectors

DMARC

Full tag analysis, policy, alignment, reporting URIs

BIMI

Logo URL and Verified Mark Certificate validation

MTA-STS

TXT record and policy file validation

Install

No dependencies, no build step.

# Run without installing

npx @trustyourwebsite/dns-auth-check trustyourwebsite.com

# Or install globally

npm install -g @trustyourwebsite/dns-auth-check

dns-auth-check trustyourwebsite.com

Common options

--format <json|text|table>Output format. Table is the default.

--dkim-selectors <s1,s2>Comma-separated DKIM selectors to check.

--check-mxAlso list and identify MX records.

--ciExit code 1 when critical or high issues are found.

--output <file>Write the report to a file.

--timeout <ms>DNS query timeout. Default 5000.

# CI mode, fails the build on critical issues

dns-auth-check example.com --ci

# Check specific selectors, JSON out

dns-auth-check example.com --dkim-selectors google,s1,mandrill --format json

→ also usable as a library via auditDNSAuth()