Your campaign did not underperform. It went to spam.
For businesses that send from their own domain, and the agencies and IT teams that look after many: MailAuthWatch is a free SPF, DKIM and DMARC check with plain-English fixes ranked by impact. Every report ends in a fix your AI agent can run. Then we re-check every day and tell you the moment someone edits DNS behind your back.
Free, no signup, public DNS only. Nothing is sent to your mail servers. Try stripe.com, github.com or your competitor's.
51 since launch · counted from our own checks, updated live
We actually count the lookups
Every include: and redirect= resolved recursively and counted against the limit of 10, so you see an SPF permerror before receivers do. Void lookups, +all and deprecated ptr get flagged.
Finds the keys you forgot about
Probes 70+ selectors used by Google, Microsoft, SendGrid, Mailchimp, HubSpot and Zendesk. Reports key length, revoked keys and testing mode. Add your own selectors too.
Fixes your agent can run
Every report ends in a prompt built only from what was measured: exact records to publish, provider steps, guardrails, and how to verify. Copy it, or open it in Claude or ChatGPT.
p=none is not a policy
Validates policy, percentage, subdomain policy and alignment, and confirms external report addresses authorised your domain, so you are never enforcement blind and your reports are not quietly binned.
A passing check today means nothing tomorrow
DNS is edited by people who have never heard of you. Monitoring is how you find out before your open rate does.
Records drift
Every new tool in the stack wants an SPF include. The eleventh one breaks SPF for all of them. Then someone rotates a DKIM key and nobody says anything.
Daily re-checks, instant alerts
Each domain is re-measured every day. Any change in grade, record text, lookup count, policy or DKIM key triggers an email, and a Slack or webhook ping on Agency.
Receipts for the client call
Watch 10 or 50 client domains from one dashboard, keep the full history of every record, and pull JSON from the API to drop a grade straight into your reporting.
Recently graded
Public checks from the last few days. Every report is re-measured from DNS when opened.
Stop finding out from the client
Starter is $29/month for 10 domains. Agency is $79/month for 50 domains with API and webhooks. Cancel any time from the billing portal.
Guides for when it is already on fire
All guides, tools and comparisons →Frequently asked questions
What does MailAuthWatch check?
The SPF, DKIM and DMARC records of a domain, plus MX, BIMI, MTA-STS and TLS-RPT, all read from public DNS. SPF includes are resolved recursively and DNS lookups are counted against the RFC 7208 limit of 10. DKIM is probed across more than 70 selectors used by common providers, and DMARC policy, percentage, alignment and reporting addresses are validated.
Why does my email go to spam even though I have SPF?
The most common reasons are an SPF record that exceeds 10 DNS lookups, which receivers treat as a permanent error, mail sent through a service that is not listed in the record, or no DKIM signature so the message fails DMARC alignment. The report shows which of these applies and what to change.
Do I need DMARC if I am a small business?
Since February 2024 Gmail and Yahoo require DMARC for anyone sending 5,000 or more messages a day, and treat SPF or DKIM as mandatory for everyone. Below that volume DMARC is still the only record that stops other people sending mail as your domain, and a p=none record with a reporting address costs nothing to publish.
How is the grade calculated?
SPF contributes up to 35 points, DKIM up to 25 and DMARC up to 40, weighted toward an enforcing policy with reporting enabled. Any critical issue caps the grade at C. Lookups that fail are reported as not measured and never counted as missing. The exact reasons are printed at the bottom of every report.
What is the difference between checking and monitoring?
A check is a one-off measurement you run yourself. Monitoring re-measures each domain every day, keeps the history, and emails you when a record changes, a DKIM key disappears, or the grade drops. Monitoring starts at $29 a month for 10 domains.
Does MailAuthWatch read my email or connect to my mail server?
No. Everything is measured from public DNS. Nothing is sent to or through your mail systems, and the free check needs no account.
What can a DNS-only check not tell me?
Whether each sending service is actually signing messages with the key it published, and which unknown sources are sending as your domain. Only DMARC aggregate reports show that per-source view. MailAuthWatch watches the DNS records those reports depend on and tells you when they change; pair it with a report analyser if you need the source breakdown.
Can my AI agent fix this for me?
Yes. Every report includes a "Fix this with your AI agent" prompt: the records exactly as published, the tasks in order of impact with the exact values to publish, steps for your mail provider and DNS host, rules such as never publishing a second SPF record, and the commands to verify. Copy it into Claude, Cursor, Copilot or ChatGPT, or open it there in one click. MailAuthWatch never changes your DNS itself; your agent makes the change, you review the diff, and the daily re-check confirms it.
Is there a free trial, and does the Agency API have documentation?
Both paid plans start with a 14-day trial that needs no card, and a 30-day money-back guarantee applies after that. The Agency JSON API is documented at /docs/api: bearer-key authentication, two endpoints, 120 requests an hour, with example responses.
Standards and sources we measure against
Every check applies the published standards rather than a vendor's opinion of them:
- RFC 7208 (SPF). Section 4.6.4 states: "SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS." The same section recommends a limit of two void lookups. The checker counts both.
- RFC 6376 (DKIM). Key length is read from the published public key; RFC 8301 (2018) deprecates keys under 1024 bits and recommends 2048.
- RFC 7489 (DMARC), including the external-destination authorisation record that receivers require before sending aggregate reports to another domain.
- Google's email sender guidelines. Since 1 February 2024, senders of 5,000 or more messages a day to Gmail must publish SPF, DKIM and a DMARC record (p=none is acceptable), align the From domain, and keep spam rates below 0.3%. Yahoo applies matching requirements.