SPF, DKIM and DMARC learning center
Build a practical mental model for email authentication using static examples. No message, domain or DNS query leaves this page.
SPF
- What it checks
- The connecting server's IP is compared with the SPF policy for the SMTP envelope-from domain.
- What it does not prove
- It does not protect the visible From address by itself and can break during forwarding.
spf=pass smtp.mailfrom=returns.example
How the three mechanisms fit together
SPF focuses on the sending path, DKIM on signed content, and DMARC on alignment with the visible From domain plus policy. Receivers combine these with reputation, filtering and local policy.
Authentication is not trust
Attackers can use authenticated look-alike domains, compromised accounts or convincing content. Always review the actual domain, request context, links and attachments.
Practice with a real header—locally
When you have a message header, use the header analyzer to summarize recorded authentication evidence without uploading it.
Open email header analyzerFrequently asked questions
Does this tool send my input to a server?
No. The tool runs in this browser after you choose to use it. Your pasted content or generated result is not added to URLs, storage, analytics or server requests.
Does a clean result guarantee that an email or account is safe?
No. These tools explain technical clues and reduce routine risk, but they cannot replace your judgment, malware protection, account security controls or advice from a qualified security professional.
Related privacy tools
Explain delivery hops and summarize SPF, DKIM and DMARC evidence without claiming absolute authenticity.
Inspect pasted email HTML for risky links, hidden images and remote tracking clues without rendering it.
Create strong passwords and passphrases locally using the browser cryptography API.
Encode UTF-8 text to Base64 or decode Base64 text locally without uploading it.
Encode URL components or inspect query parameters locally without opening the address.
Generate SHA-256 or SHA-512 text hashes locally with browser Web Crypto.
Format, minify and validate JSON locally without uploading it.
Create and download QR codes locally without sending text to a server.
Resize, compress and convert JPEG, PNG or WebP locally. Your image never leaves this browser.
Count and tidy text in this browser without uploading your content.
Check how sender, subject and preview text may fit in a compact inbox row before running a real client test.
Translate explicit ISO 8601 timestamps, Unix seconds and Unix milliseconds while debugging delivery records.
Paste an email to find its likely verification code and copy the best match automatically.
Turn pasted email HTML into readable plain text without rendering active or remote content.
Estimate how selected attachments may grow after Base64 and MIME packaging before sending an email.
Explain what an email address may reveal from its visible structure without verifying, contacting or uploading it.