About
A free set of email authentication tools, built because the existing free checkers tell you what is broken and stop there.
Why it exists
Since February 2024, Google and Yahoo have required SPF, DKIM and DMARC from anyone sending them mail in volume. A lot of organisations discovered at that point that they had no idea what any of those were.
There is no shortage of tools that will tell you your SPF record exceeds the ten-lookup limit. There are very few that hand you a corrected record. That gap is the whole reason this exists: every finding here ends in something you can publish or a specific action, not a description of the problem.
What it checks
- Domain checker — SPF (with full include-chain evaluation and lookup counting), DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and DNSSEC.
- Header analyzer — the delivery path and hop delays of a specific message, and why DMARC passed or failed. Runs entirely in your browser.
- Sending IP checker — 8 blocklists and forward-confirmed reverse DNS.
- JSON API — all of the above, no key required.
What it deliberately will not tell you
Overclaiming is how tools in this space lose trust, so these limits are stated here as well as in the results:
- “No DKIM found” is not proof that DKIM is missing
- Selectors cannot be listed from DNS. We try 50 common ones and say so. Some providers — Amazon SES among them — use random selectors that are unguessable by construction.
- SPF lookup counts are worst-case
- A real evaluator stops at the first match, so a sender listed early may never reach term eleven. We count the full walk, because the sender that breaks is the one in the last include.
- SPF macros are counted but not resolved
- Terms like
exists:%{i}…expand using the connecting server's address. There is no honest static answer, so they are reported as unevaluable rather than guessed. - A refused blocklist query is never reported as “not listed”
- Some lists decline queries under certain conditions. When that happens you get “unknown”, because a false all-clear on a tool people reach for mid-incident is worse than no answer.
- A clean result is not a guarantee of delivery
- Dozens of private blocklists exist, and every mailbox provider runs internal reputation scoring that is invisible from outside. This checks configuration, which is necessary but not sufficient.
What it records about you
No cookies, no third-party scripts, no advertising, no accounts. The pages load no JavaScript at all except the header analyzer, which needs it to parse in your browser.
The domains, headers and addresses you check are never stored. Header analysis never leaves your browser at all. The only thing kept is a daily count of how often each page was viewed and how many checks ran — no IP addresses, no sessions, nothing that identifies a person or a domain.
Reporting a wrong result
Please do. Correctness is the entire value here, and a checker that is confidently wrong is worse than no checker. Several bugs have already been found by pointing the tools at domains whose real configuration was known.
Email hello@notspoofed.com with:
- the domain, IP or headers you checked;
- what the tool said;
- what you believe the correct answer is, and how you know.
That last line matters most — the useful reports are the ones that say “the record actually reads X, here is the dig output”.
Who runs it
One person, independently, on a single server. It is not backed by a vendor and does not sell your results to one. There is no upsell in the findings: where a commercial product genuinely is the right answer — DMARC report monitoring, for instance — it says so plainly rather than steering you somewhere.
The checks are built directly against the RFCs (7208 for SPF, 6376 for DKIM, 7489 for DMARC, 8461 for MTA-STS) and tested against a corpus of real domains whose configuration is verified independently.
Contact
hello@notspoofed.com — bug reports, corrections, and requests for a higher API rate limit if you are building something.