Enter a domain
Type the domain whose mail you need to trust, yours or a sender's. Authentication lives at the domain level, so there's no address to paste and nothing to install.
Email authentication check
The SPF, DKIM & DMARC Check That Shows What Fails.
See how a check reads a domain's SPF, DKIM, and DMARC in one pass, and what a pass or fail means for spoofing. Sample result, no signup.
Free to run. No signup — public DNS data.
Trusted by 500,000+ leading GTM teams of all sizes
From domain to verdict
How SPF, DKIM, and DMARC check works
No login, no install. Enter any domain and Verifox reads SPF, DKIM, and DMARC in one pass - showing what passes, what fails, and why.
Check SPF, DKIM & DMARC
The check resolves all three records in one pass, the same stage our verification engine runs on every domain it scores. The demo above shows that read on a sample result.
Read the pass or fail verdict
See a pass or fail for each record in plain English, and whether the domain is protected from spoofing. That's the inbox-placement signal a verification starts from.
The plain-English version
SPF, DKIM, DMARC Checks Explained
One question of a domain's DNS: is its mail provably genuine, and is it protected from being spoofed?
An SPF, DKIM, and DMARC checkreads the three DNS records behind your email's trust. SPF lists the servers allowed to send for your domain, DKIM adds a signature proving a message came from you unaltered, and DMARC ties them together and tells receivers what to do on a fail. Together they block spoofing and keep your real mail out of spam.
The 9-point engine
Nine checks, one verdict
The same nine-check engine our paid email verification API runs. Every email, every verification, every time.
- 01
Syntax
Every address runs a full RFC 5321 and RFC 5322 compliance pass before a single network call goes out. The engine catches what visual scanning misses, the double dot in
[email protected], the trailing period, the IDN homograph that looks valid but resolves to a different domain.Bundled typo suggestions let your form offer “did you mean [email protected]?” instead of rejecting silently.
/dashboard/verify
- 02
Domain & MX
Once syntax passes, the engine resolves the domain. We confirm the DNS records exist, fetch the MX record priority list in order, and verify at least one mail-exchange server is actively accepting connections right now.
Misspelled domains like
gmial.com, expired domains, and parked-for-sale domains all fail this gate before the engine wastes a single SMTP roundtrip./dashboard/verify
- 03
SMTP handshake
The engine opens a TCP connection on port 25, performs the EHLO handshake, then negotiates
MAIL FROMandRCPT TO. Every server response code (220, 250, 550, 552) is parsed deterministically against the IANA enhanced-status registry.This is the moment a mailbox proves it actually exists. No third-party guesses, no statistical heuristics, just the receiving server's own answer.
/dashboard/verify
- 04
Catch-all detection
Some domains accept every email regardless of whether the mailbox exists, a setup known as a catch-all configuration. The engine sends a deterministic probe to a deliberately fake address (
[email protected]); if the server returns the same 250 OK it returned for the real address, the domain is catch-all.The verdict isn't dropped, it's flagged RISKY so you know the deliverability signal is degraded.
/dashboard/verify
- 05
Disposable
The engine maintains a curated registry of 10,247 disposable email providers, including Mailinator, Guerrilla Mail, 10MinuteMail, Tempmail, and the long tail of regional clones.
Any address matching the blocklist is flagged INVALID. Deliverability to a mailbox that exists for 10 minutes and is never checked is functionally zero, regardless of whether the SMTP handshake passes.
/dashboard/verify
- 06
Role address
info@,support@,no-reply@,admin@,billing@. These are shared inboxes, not individuals.The engine extracts the local-part of every address, matches it against the known role-prefix registry, and tags the result with a reduced engagement score.
You don't drop them automatically. The verdict flags them as roles so you can decide.
/dashboard/verify
- 07
Domain age
Fresh-spam domains registered hours ago are the single biggest source of inbound abuse. The engine queries WHOIS and RDAP for every unique domain, extracts the registration date, and flags anything under 30 days old with a “fresh” warning.
Domains aged 5+ years pick up a corresponding trust signal. The same heuristic spam filters have been using since the early 2000s, ported into the verdict.
/dashboard/verify
- 08
Email authentication
SPF, DKIM, and DMARC together prove the sender is authorised to send from that domain.
The engine reads each policy via DNS, validates SPF includes recursively, scans six common DKIM selectors, and confirms DMARC alignment with the
From:header.A failing DMARC policy means the sender can be spoofed, so the verdict warns you before you reply.
/dashboard/verify
- 09
Mailbox state
Beyond “exists vs doesn't exist”, the engine extracts the precise mailbox state from the SMTP server's response. Full inbox (552 / 522 quota), disabled mailbox (550 5.1.1), out-of-office autoresponder, frozen account.
Each state maps to a specific retry policy. Full inbox retries in 6 hours. Disabled drops permanently. The verdict tells you which bucket the bounce belongs in so your retry logic doesn't waste cycles.
/dashboard/verify
What it tells you
What an MX lookup reveals about a domain
An MX lookup is a read-only window into how a domain receives email. In one query you learn who runs the mail, how it routes, and if its sendable
Verification engine
9checks on every
checks on every
address
The same DNS resolution the Verifox verification engine runs first on every address it checks.
Who runs the mail
The MX hosts name the provider — Google Workspace, Microsoft 365, Proofpoint, or a self-hosted server.
Routing and priority
Records return lowest-number-first, so you read the primary server and its fallbacks straight away.
A deliverability signal
No MX record, or a broken one, means mail bounces before it is ever sent.
The first deliverability step
An MX lookup starts the story; verifying the address confirms the mailbox itself is real.
Verify the mailbox itself
An MX lookup is only the first step. Verifying the address confirms the mailbox is real and deliverable.
Provider at a glance
The single most useful thing a mail exchanger lookup tells you — who to talk to about mail.
How we stack up
Verifox vs other
authentication checkers
MXToolbox, DMARCLY, and Mimecast all check SPF, DKIM, and DMARC. Verifox reads each as a plain-English pass or fail.
★ The complete checkVerifox
MXToolbox
DMARCLY
Mimecast
MXToolboxCheck table
DMARCLYPlain English
MimecastPlain English
MXToolbox—
DMARCLY—
Mimecast—
MXToolbox
DMARCLY
Mimecast
MXToolbox
DMARCLY
Mimecast
MXToolbox
DMARCLY
Mimecast
MXToolbox
DMARCLY
Mimecast
MXToolboxSubscription
DMARCLYSubscription
MimecastSubscription
Pricing
Pay once, or not at all
Most tools reset your balance every month. Verifox sells credits that sit in your account until you spend them.
FreeProve it on your own list before you spend anything.$0
forever
1,000credits on signup
No card required
2,500 with a work email
Free includes
- All 9 checks included
- Full API and bulk CSV
- Catch-all confidence scoring
- No card required
Most popular
Credit packsBuy once, spend whenever. Slide to price your list.$59
one time
10,000credits
$0.0059 eachSAVE 34%
Everything in Free, plus
- Credits never expire
- Verify or find from one pool
- Up to 79% off at volume
- No contract, no minimum
Verifox ONECredits land monthly and stack on your balance.$79
per month
15,000credits a month
$0.0053 each
Unused credits roll over
Everything in packs, plus
- Unused credits roll over
- Our lowest per-email rate
- 50 requests per second API
- Cancel anytime
One credit verifies one address; a find costs 10. All prices in USD, checkout via Stripe.
Built for the teams that ship outbound
Growth leads, marketers, and engineers running real campaigns on real lists, with a verified email on every byline.
90% lower bill, 0.4% bounces
We were paying ZeroBounce a four-figure monthly bill and still landing 3% bounces on cold campaigns. Switched the pipeline to Verifox, dropped to 0.4% bounces, and cut the bill by more than 90%.
Thomas G.GTM Lead, Stripe
Catch-all finally has a verdict
Other tools flag 30% of our B2B list as 'risky catch-all' and leave the call to us. Verifox returns a real verdict on those addresses, with a confidence score. We send more, we send safer.
Brittany K.GTM Lead, HubSpot
Reputation rebuilt in 6 weeks
We had a Gmail spam-folder problem after a bad list import. Verifox cleaned the list and the warmup ran on the same engine. Back in primary inbox in six weeks. One vendor, half the cost.
Dale M.GTM Lead, Slack
0.7% bounce on 50k
Ran a 50,000-address outbound list through Verifox before our quarterly campaign. Bounces landed at 0.7%, sender reputation didn't move, replies were up 22% over last quarter.
Erica K.GTM Lead, Discord
MCP in 10 minutes
Their MCP server let me wire email verification directly into our internal Claude agent in about ten minutes. Zero glue code. No other vendor in this space has thought about that workflow.
Greg L.GTM Lead, OpenAI
10k/min held under 400ms
Tested Verifox at 10,000 verifications per minute on a Tuesday morning. Latency held under 400ms median, no soft failures, no rate-limit walls. The vendor we benched throttled at 2,000/min.
Rini V.Product Manager, Vercel
Hygiene that doesn't break pipeline
Our SDRs were enriching from three tools and 14% of the emails were invalid before they hit the sequencer. Verifox sits in the pipeline now and the team stopped seeing 'undeliverable' replies the next week.
Jonathan A.GTM Lead, MongoDB
Bulk that actually ships
Bulk upload, sorted CSV back in twenty minutes, plug into our growth stack. The half-day list-hygiene project per cohort turned into something the marketing intern runs on autopilot.
Emma F.GTM Lead, Linear
Scores you can act on
Verifox returns a 0-100 confidence score per address, not just a label. We thresholded at 75 for the cold sequencer, 60 for nurture, and our deliverability team finally has a knob they can tune.
David H.GTM Lead, Snowflake
90% lower bill, 0.4% bounces
We were paying ZeroBounce a four-figure monthly bill and still landing 3% bounces on cold campaigns. Switched the pipeline to Verifox, dropped to 0.4% bounces, and cut the bill by more than 90%.
Thomas G.GTM Lead, Stripe
Reputation rebuilt in 6 weeks
We had a Gmail spam-folder problem after a bad list import. Verifox cleaned the list and the warmup ran on the same engine. Back in primary inbox in six weeks. One vendor, half the cost.
Dale M.GTM Lead, Slack
MCP in 10 minutes
Their MCP server let me wire email verification directly into our internal Claude agent in about ten minutes. Zero glue code. No other vendor in this space has thought about that workflow.
Greg L.GTM Lead, OpenAI
Hygiene that doesn't break pipeline
Our SDRs were enriching from three tools and 14% of the emails were invalid before they hit the sequencer. Verifox sits in the pipeline now and the team stopped seeing 'undeliverable' replies the next week.
Jonathan A.GTM Lead, MongoDB
Scores you can act on
Verifox returns a 0-100 confidence score per address, not just a label. We thresholded at 75 for the cold sequencer, 60 for nurture, and our deliverability team finally has a knob they can tune.
David H.GTM Lead, Snowflake
Catch-all finally has a verdict
Other tools flag 30% of our B2B list as 'risky catch-all' and leave the call to us. Verifox returns a real verdict on those addresses, with a confidence score. We send more, we send safer.
Brittany K.GTM Lead, HubSpot
0.7% bounce on 50k
Ran a 50,000-address outbound list through Verifox before our quarterly campaign. Bounces landed at 0.7%, sender reputation didn't move, replies were up 22% over last quarter.
Erica K.GTM Lead, Discord
10k/min held under 400ms
Tested Verifox at 10,000 verifications per minute on a Tuesday morning. Latency held under 400ms median, no soft failures, no rate-limit walls. The vendor we benched throttled at 2,000/min.
Rini V.Product Manager, Vercel
Bulk that actually ships
Bulk upload, sorted CSV back in twenty minutes, plug into our growth stack. The half-day list-hygiene project per cohort turned into something the marketing intern runs on autopilot.
Emma F.GTM Lead, Linear
90% lower bill, 0.4% bounces
We were paying ZeroBounce a four-figure monthly bill and still landing 3% bounces on cold campaigns. Switched the pipeline to Verifox, dropped to 0.4% bounces, and cut the bill by more than 90%.
Thomas G.GTM Lead, Stripe
0.7% bounce on 50k
Ran a 50,000-address outbound list through Verifox before our quarterly campaign. Bounces landed at 0.7%, sender reputation didn't move, replies were up 22% over last quarter.
Erica K.GTM Lead, Discord
Hygiene that doesn't break pipeline
Our SDRs were enriching from three tools and 14% of the emails were invalid before they hit the sequencer. Verifox sits in the pipeline now and the team stopped seeing 'undeliverable' replies the next week.
Jonathan A.GTM Lead, MongoDB
Catch-all finally has a verdict
Other tools flag 30% of our B2B list as 'risky catch-all' and leave the call to us. Verifox returns a real verdict on those addresses, with a confidence score. We send more, we send safer.
Brittany K.GTM Lead, HubSpot
MCP in 10 minutes
Their MCP server let me wire email verification directly into our internal Claude agent in about ten minutes. Zero glue code. No other vendor in this space has thought about that workflow.
Greg L.GTM Lead, OpenAI
Bulk that actually ships
Bulk upload, sorted CSV back in twenty minutes, plug into our growth stack. The half-day list-hygiene project per cohort turned into something the marketing intern runs on autopilot.
Emma F.GTM Lead, Linear
Reputation rebuilt in 6 weeks
We had a Gmail spam-folder problem after a bad list import. Verifox cleaned the list and the warmup ran on the same engine. Back in primary inbox in six weeks. One vendor, half the cost.
Dale M.GTM Lead, Slack
10k/min held under 400ms
Tested Verifox at 10,000 verifications per minute on a Tuesday morning. Latency held under 400ms median, no soft failures, no rate-limit walls. The vendor we benched throttled at 2,000/min.
Rini V.Product Manager, Vercel
Scores you can act on
Verifox returns a 0-100 confidence score per address, not just a label. We thresholded at 75 for the cold sequencer, 60 for nurture, and our deliverability team finally has a knob they can tune.
David H.GTM Lead, Snowflake
Enterprise-grade security and scale
Every layer of the stack carries a third-party attestation, so you can ship into regulated industries without rebuilding your compliance posture.
SOC 2 Type II
Independently audited to the SOC 2 Type II standard.
GDPR
Built for the EU with full GDPR data-subject rights.
CCPA
California opt-out, do-not-sell, plus DSAR handling.
ISO 27001
Information security held to the ISO 27001 standard.
ISO 42001
AI governance aligned to the new ISO 42001 standard.
Free field manual
The Dead List
An investigation into the money leaking out of your list - and the nine checks that decide whether your email is read, or never arrives at all.
Get the free manual
57 pages, free PDF, no signup
Common questions
SPF, DKIM, and DMARC, answered.
Common questions about email authentication: what SPF, DKIM, and DMARC each protect against, why a domain fails, and which record to fix first.
What are SPF, DKIM, and DMARC?
They are the three DNS records that prove your email is genuine. SPF lists which servers may send for your domain. DKIM adds a signature so a receiver can confirm a message was not tampered with. DMARC ties the two together and tells receivers what to do when a message fails.
Together they stop someone spoofing your domain and keep your real mail out of spam. The tool above walks the check on a sample result.
How do I check SPF, DKIM, and DMARC for a domain?
You can query them by hand with dig TXT example.com for SPF, dig TXT _dmarc.example.com for DMARC, and a selector lookup for DKIM, but those return raw TXT strings you have to parse yourself.
Running the check through Verifox reads the records back in plain English, flags what passes and fails, and flows straight into a real mailbox verification when you need to go past authentication. No account, no install.
What is an SPF record and how does it pass?
An SPF record is a single TXT entry, starting v=spf1, that lists the servers allowed to send mail for your domain. When a receiver gets a message, it checks whether the sending server is on that list. If it is, SPF passes.
SPF fails most often when the record is missing, or has more than ten DNS lookups, the hard limit that causes a permerror. Ending in ~all (soft fail) or -all (hard fail) tells receivers how strictly to treat unlisted senders.
What is a DKIM record and why does the check fail?
DKIM publishes a public key in your DNS at a selector._domainkey hostname. Your platform signs every outgoing message with the matching private key, and the receiver uses the published key to confirm the signature is valid and the message was not altered.
A DKIM check fails when the selector is not published, the key was rotated but DNS never updated, or the record is malformed. Because each service uses its own selector, a domain can pass DKIM for one sender and fail for another.
What is a DMARC record, and what does p=none vs p=reject mean?
A DMARC record is a TXT entry at _dmarc.yourdomain that sets a policy. The p= tag tells receivers what to do when a message fails both SPF and DKIM alignment.
p=none monitors only, the safe starting point while you collect reports. p=quarantine sends failing mail to spam, and p=reject blocks it outright. A domain only earns full spoofing protection at quarantine or reject; staying on none leaves the door open.
Why does my SPF, DKIM, or DMARC check fail?
The common causes are a record that was never published, one with a typo, an SPF record over the ten-lookup limit, a DKIM selector that does not match what your platform signs with, or a DMARC policy left at p=none. Any one can put mail in spam or let someone send as your domain.
A record-by-record check tells you which of the three is the problem. An email deliverability test then shows what that authentication gap does to inbox placement.
How do I fix a failing SPF, DKIM, or DMARC record?
Fixes live in your DNS. For SPF, publish a single v=spf1 record covering every service you send through, under ten lookups. For DKIM, turn on signing in each platform and publish the selector it gives you. For DMARC, start at p=none with a rua reporting address, then raise to quarantine or reject as reports come back clean.
After each change, query the record with dig or your DNS console to confirm it is live before re-testing.
Do I really need all three of SPF, DKIM, and DMARC?
Yes. SPF and DKIM each prove a different thing — the sending server and the message integrity — and DMARC is the policy that makes them count and sends you aggregate reports. Many inbox providers now expect all three from bulk senders, and a domain missing one or two is easier to spoof.
Checking all three in one pass is why this tool exists, running the same authentication stage our verification engine uses when scoring a domain's deliverability.
Can I check SPF, DKIM, and DMARC for many domains in bulk?
Yes. The single check above is free with no account. For a list of domains, the REST API returns the SPF, DKIM, and DMARC status for each one, so you can run a bulk authentication check across a whole portfolio of domains programmatically.
Bulk checks run on the same pay-as-you-go credits as the rest of the platform, localized to your region, and those credits never expire.
Can I run an authentication check from my own app or AI agent?
Yes. The REST API reference documents an endpoint that returns the SPF, DKIM, and DMARC status for any domain, so you can wire authentication checks into your CRM, your onboarding flow, or any tool that speaks REST.
Verifox also ships native MCP server support, so AI agents (Claude, Cursor, custom LLM apps) can check a domain's authentication and verify addresses without glue code. Live uptime and incident history are at status.verifox.ai.