Email authentication guides and tools

Practical, vendor-neutral explanations of SPF, DKIM and DMARC, and free tools that measure them from public DNS.

Guides

Why SPF permerror happens at the 11th lookup and five ways to get back under the limit without dropping senders.

A staged rollout for DMARC enforcement that does not lose legitimate mail.

The DKIM selectors used by Google Workspace, Microsoft 365, SendGrid, Mailchimp, HubSpot, Zendesk, Postmark, Amazon SES and others.

Expand every include, count DNS lookups against the limit of 10, and see what to change.

Find published DKIM keys across 70+ common selectors and verify key strength.

Validate policy, percentage, alignment and external report authorisation.

The full include tree with the lookup cost of each branch.

Public checks run in the last few days. Every report is measured live from DNS when it is opened.

Every guide ends the same way: records drift and nobody notices. MailAuthWatch re-checks your domains daily and alerts you on any change.