SPF / DKIM / DMARC / BIMI
My domains
A place to check your email security and work through the setup.
Start with your first domain
Check the records, understand the findings, and keep track of what needs to be done. Everything here is free to use.
Free Dmark account
Keep your work across devicesCreate a free account when you want to save your domains and progress beyond this browser.
Save domains and checklist progress to your account. Use an email link to register or sign in, then import your browser domains when you are ready.
Dmark / Kastro
Free email authentication checks from Kastro
Dmark checks public DNS records for SPF, DKIM, DMARC and BIMI. Add a domain to see its DNS readiness score, review findings and follow a guided setup plan. Use it without an account, or create a free account to save your domain checklist across devices.
How Dmark works
What does the domain score measure?
Five observed DNS checks are worth 20 points each: valid SPF within the 10-lookup limit; healthy SPF with fewer than eight lookups and no assessed warnings; a published DKIM key; valid DMARC; and full DMARC enforcement with p=reject, pct=100 and no assessed DMARC warnings. Incomplete checks do not receive a score. A score of 100 does not guarantee email delivery, validate DKIM signatures or prove sender alignment. Manual checkmarks and BIMI do not change the score.
What do SPF, DKIM, DMARC and BIMI do?
SPF publishes which servers may send mail for a domain. DKIM publishes a key used to verify signed messages; Dmark checks the DNS key record, not message signatures. DMARC checks alignment with the From domain and publishes a policy and reporting destinations. BIMI publishes brand information that supported email providers may display, subject to their logo and certificate requirements.
Do I need an account?
No. Your saved domains, selectors and manual checkmarks can stay in a cookie in this browser. A free account lets you save the domain checklist across devices. Domain scores are cached locally and must be rechecked for current findings; an account does not provide continuous monitoring.
Does Dmark change my DNS or host SPF?
No. Dmark reads public DNS and provides guidance. You make any changes through your DNS provider. The advanced SPF generator creates an on-demand snapshot of supported dependencies. It is not hosted SPF and does not automatically update when provider IP addresses change.
What happens to my domain when I run a check?
The selected domain is sent to Kastro Lookup for its SPF and DMARC assessment, and public DNS is queried for DKIM and BIMI records. Browser cookies store your saved domain checklist. If you sign in and save, the checklist is stored with your account. Domain names are excluded from Dmark’s custom analytics events.
Why might a DKIM key not be found?
A domain can use a custom DKIM selector that common-selector discovery does not find. Enter the selector supplied by your email provider, or the s= value from a DKIM-Signature header, and recheck. An undiscovered key does not prove DKIM is missing. Verify real email from every sending service before increasing DMARC enforcement.
Dmark is a free tool from Kastro. If you want help reviewing your domain’s email configuration, contact Kastro. Talk to Kastro ↗