Home›Tools›DNS Checker
Free tool · No signup

Free DNS & email auth checker

Enter a domain to see its A, MX, NS, and TXT records, plus whether SPF and DMARC are configured and which common DKIM selectors resolve.

Try:

* This tool performs read-only public DNS lookups only. It does not scan ports or probe mail servers.

What is a DNS and email authentication checker?

A domain's DNS records control where its website and email are routed, and a separate set of TXT-based records, SPF, DKIM, and DMARC, control which servers are allowed to send email on the domain's behalf and what happens to messages that fail that check. Misconfigured or missing email authentication is one of the most common reasons legitimate email lands in spam, and one of the easiest gaps for attackers to exploit when spoofing a domain in phishing campaigns.

IntelCue's DNS & Email Auth Checker queries a domain's public DNS records directly, the same kind of lookup any mail server or browser performs, and summarizes what it finds: core records (A, AAAA, MX, NS, CNAME, TXT), whether SPF and DMARC are present, and whether a DKIM key resolves under a handful of commonly used selector names. The result is a plain-language summary of what's configured and what's missing, in seconds.

How it works

01
Enter a domain
Type any domain: your own, a client's, or one you're evaluating. No login, and only public DNS records are queried.
02
We query core DNS records
We look up A, AAAA, MX, NS, CNAME, and TXT records in parallel, directly from public DNS.
03
We check email authentication
We look for an SPF record, a DMARC policy, and DKIM keys under common selector names, and summarize what's configured and what's missing.

This is a snapshot. IntelCue watches continuously.

This tool checks a domain once, on demand. IntelCue is a competitive intelligence platform that tracks competitors' infrastructure, newsletters, blogs, news, and Google Ads continuously, alerting you the moment something changes. Ask it anything in natural language right inside Claude or ChatGPT.
Free for early usersNo credit card required

Frequently asked questions

What are SPF, DKIM, and DMARC and why do they matter?
SPF, DKIM, and DMARC are DNS-based email authentication standards that tell receiving mail servers which senders are allowed to send email for a domain, and what to do with messages that fail that check. Together they make it harder for attackers to spoof a domain in phishing emails and improve legitimate email's chance of reaching the inbox instead of spam.
Why is my email going to spam?
Missing or misconfigured SPF, DKIM, or DMARC is one of the most common causes, since major receiving providers like Gmail and Yahoo now require all three for bulk or commercial senders. Other causes include poor sender reputation, spammy content, and low recipient engagement, but authentication is the first thing to verify and rule out.
Why does this tool only check 'common' DKIM selectors?
DKIM keys are published under a selector name chosen by whichever service sends a domain's mail, for example google._domainkey.example.com. That selector isn't published anywhere discoverable via public DNS, so this tool checks a list of common selector names used by popular email providers. A domain may have DKIM configured under a selector we don't check, so a 'not found' result here is not conclusive proof DKIM is absent.
What does it mean if SPF or DMARC is missing?
Without an SPF record, receiving mail servers have no authoritative list of which servers are allowed to send mail as that domain, making spoofing easier. Without DMARC, there's no policy telling receivers what to do with messages that fail SPF or DKIM, and no reporting on abuse attempts. Both are considered baseline email security hygiene.
What's the difference between DMARC's p=none, p=quarantine, and p=reject?
These are DMARC policy levels of increasing strictness. p=none means monitor only and take no action on failing messages, p=quarantine asks receivers to treat failing messages with suspicion (often routing to spam), and p=reject asks receivers to block failing messages outright.
What are A, AAAA, MX, NS, CNAME, and TXT records, briefly?
A records map a domain to an IPv4 address, and AAAA records do the same for IPv6. MX records list which mail servers accept email for a domain. NS records list a domain's authoritative name servers. CNAME records alias one hostname to another. TXT records hold arbitrary text used for things like domain verification and, as covered here, SPF/DMARC/DKIM.
Is this a vulnerability scanner?
No. This tool performs read-only public DNS lookups only, the same kind of query any computer makes when visiting a website or sending email. It does not scan ports, probe live mail servers, or attempt to access anything private.
Is the DNS checker free?
Yes. It's completely free, requires no signup, and there's no limit beyond a light rate limit to keep the service fair for everyone.

Explore more IntelCue solutions

Competitive Intelligence
Full market & competitor monitoring suite
Google Ads Transparency
Monitor competitor search ad campaigns
Certificate Transparency
Track new domains via CT logs
Website Change Tracker
Detect changes on competitor pages

New to the topic? Browse the competitive intelligence glossary.

Related reading

AI-First Competitive Intelligence: The Shift Changing CI in 2026
AI-first competitive intelligence is replacing manual CI workflows. Here's what's changing, which tools are adapting, and how to pick the right approach.
Free Subdomain Finder: Spot Competitor Launches via CT Logs
Discover any company's subdomains instantly using Certificate Transparency logs. Find new subdomains before sites go live. Free, no signup required.
The Best Competitive Intelligence Tools for 2026: A No-Nonsense Guide
The best competitive intelligence tools for 2026, broken down by category. Honest comparisons, no vendor bias. Find the right fit for your team.