Bulk email authentication checker: SPF, DKIM, DMARC and MX for up to 500 domains
A bulk email authentication checker looks up SPF, DKIM, DMARC and MX for many domains at once. Paste up to 100 domains, or 500 after a Google sign-in, and each gets a pass, warn or fail with a plain-English reason, such as a missing DMARC record or two SPF records. Download it all as CSV.
Sample result
acme.example passes SPF, DKIM, DMARC and MX. mail.acme.example fails: it has no DMARC record.
- Domain
- mail.acme.example
- SPF
- Pass
- DKIM
- Warn: no key on common selectors
What this means for you
Fix the failing domains before they send, or Gmail and Yahoo may filter their mail.
- SPF, DKIM, DMARC and MX for each domain
- A plain-English reason for every warning
- 100 domains a run, 500 when signed in
- Download every record and reason as CSV
- SPF
- DMARC
- Bulk
By SimpleVerifier Team · Last updated
How do I check email authentication for a list of domains?
- Paste up to 100 domains, one per line (500 when signed in with Google), or email addresses or website URLs; the domain is taken from each. You can also upload a CSV.
- Press Check authentication. Domains are checked ten at a time, straight from DNS.
- Read the summary, then each row: SPF, DKIM, DMARC and MX each pass, warn or fail, and the first problem is spelled out.
- Tick Show only problems to see what needs fixing, then download the CSV with every record and reason.
Example
- You enter
- Two domains pasted one per line:
acme.exampleandmail.acme.example. - You get
acme.examplepasses: SPF ends in~all, DKIM is found on the google selector, DMARC isp=rejectand there is an MX record.mail.acme.examplefails with the reason spelled out: it has no DMARC record. Download every record and reason as CSV.- Limits
- Up to 100 domains a run without an account and 500 when signed in with Google. DKIM is checked on common selectors only.
How do I check SPF, DKIM and DMARC for multiple domains?
Paste the domains and press Check authentication. For each one the checker reads the TXT record at the domain for SPF (RFC 7208), the TXT record at _dmarc. for DMARC (RFC 7489), <selector>._domainkey. for DKIM on the selectors the main providers use, and the MX records. These are the same checks, with the same wording, as our single-domain bulk sender checker.
It runs 100 domains a run without an account and 500 when you sign in with Google. Nothing is sent to the domains' own mail servers: every answer comes from DNS.
What do pass, warn and fail mean?
Fail means SPF or DMARC is missing or broken: no record, more than one SPF record, an SPF record over the 10-lookup limit or ending in +all, or a DMARC record without a valid p= policy. Google and Yahoo require SPF, DKIM and DMARC from bulk senders, so a domain that fails here is at risk of having its mail sent to spam or rejected.
Warn means nothing is broken outright but something is worth a look: no DKIM key on the common selectors, a DKIM key shorter than the 2048 bits RFC 8301 recommends, DMARC at p=none with no rua= reports, an SPF record with no all at the end, or no MX record. Pass means all four checks pass. A lookup that timed out shows as unknown rather than a guess.
Why does a domain show no DKIM key?
Because DKIM keys sit under a selector the sender chooses, and DNS can't list them. The checker tries the selectors that Google Workspace, Microsoft 365, Mailchimp, SendGrid, Zoho, Proton and other large platforms publish, plus a few common defaults. Platforms such as Amazon SES and Postmark use a selector unique to each account, so a domain can sign every message and still show no key here.
That's why a missing DKIM key is a warning, not a fail. If you know the selector, check it in the DKIM checker.
Who needs to check email authentication in bulk?
Anyone responsible for more than a handful of sending domains: agencies onboarding clients, cold emailers with a dozen secondary domains, and IT teams auditing a portfolio. One run shows which domains are ready to send and which need DNS changes first.
Authentication covers the sending side. The other half of deliverability is the list: bounces from invalid addresses hurt a domain's reputation however well it is authenticated, so verify the list before the first campaign from a new domain.
How is this different from checking one domain at a time?
| This bulk checker | A single-domain checker | |
|---|---|---|
| Domains per run | 100, or 500 signed in | One |
| Checks | SPF, DKIM (common selectors), DMARC, MX | Usually one record type, in more depth |
| Output | Pass, warn or fail per domain, plus a CSV | A detailed report for one domain |
| Custom DKIM selector | No | Yes, in the DKIM checker |
Who uses this tool, and for what?
- Agencies
- Audit every client domain before a campaign goes out, and send each client the CSV of what to fix.
- Cold emailers
- Confirm that each secondary sending domain has SPF, DKIM and DMARC before warm-up starts.
- IT and security teams
- Find domains in a portfolio with no DMARC record, which anyone can spoof without a policy stopping them.
- Deliverability consultants
- Get a first pass over a prospect's domains in one run before a deeper per-domain review.
What can’t this tool tell you?
- DKIM is checked on common selectors only. An account-specific selector can't be found from DNS alone.
- It reads what is published, not what passes: alignment and real pass rates show only in a delivered message's headers or DMARC reports.
- The SPF lookup count is for the top level of the record. For the nested count, use the SPF lookup counter.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How do I check SPF, DKIM and DMARC for many domains at once?
- Paste the domains into a bulk checker like this one. It reads each domain's SPF, DMARC, DKIM and MX records from DNS and gives each domain a pass, warn or fail, with a CSV of the results.
- Is this bulk DMARC checker free?
- Yes. It's a free tool: up to 100 domains a run with no account, and up to 500 a run when you sign in with Google, with no card.
- What is the difference between SPF, DKIM and DMARC?
- SPF lists the servers allowed to send for a domain. DKIM signs each message with a key published in DNS. DMARC tells receivers what to do when a message fails both, and where to send reports. Read more in SPF, DKIM and DMARC explained.
- Does DMARC p=none count as passing?
- It meets Gmail's and Yahoo's requirement that a DMARC record exists, so it passes here when it also has a rua= address for reports. Without rua= it's a warning, because you get no reports and the policy blocks nothing.
- Why is DKIM a warning when I know it's set up?
- Your platform probably uses a selector we don't try, such as an account-specific one on Amazon SES or Postmark. Check it with your selector in the DKIM checker.
- Does this send email to the domains?
- No. Every check is a DNS lookup. Nothing connects to the domains' mail servers.
Sources
Authentication and capacity are half of deliverability.
The other half is who you send to. Every hard bounce counts against the domain and inboxes you are sending from, and nothing in DNS can tell you which addresses on your list are dead.
- Bulk verification with real SMTP mailbox checks
- Hard bounces removed before a send, not discovered after
- Catch-all, disposable and role detection on every row
One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.