Skip to the content
Agent Tools

How to check a domain's DMARC policy, DKIM keys and the 10-lookup SPF limit: stripe.com across 4 tools

Under RFC 7208 section 4.6.4, a receiving mail server stops evaluating your Sender Policy Framework (SPF) record and returns a permanent error (permerror) the moment your include, a, mx, ptr, exists and redirect mechanisms exceed 10 DNS lookups. We tested stripe.com across 4 email-authentication tools to compare DMARC policy inspection, recursive SPF lookup counting, DKIM selector checks and Gmail and Outlook sender-rule verification.

By OpenKrill. Published 2026-10-20. Every DNS record, lookup count and response time below comes from live calls to Domain Mail Check (https://mailcheck.openkrill.app/mcp) and Cloudflare and Google DNS over HTTPS on 2026-10-20 between 06:18 and 09:43 UTC.

The short answer

On 2026-10-20, calling check_email_auth on stripe.com returned spoofing protection grade A in 1,077 ms (and confirmed selector google in 1,558 ms when passed dkim_selectors: ["google"]): stripe.com publishes a strict DMARC p=reject policy at pct=100 with aggregate reporting to mailto:dmarc-reports@stripe.com, a single SPF ~all (softfail) record that consumes 7 of the 10 allowed DNS lookups across spf1.stripe.com, greenhouse-outbound-mail.stripe.com and _spf.qualtrics.com, and 5 Google Workspace MX hosts (led by aspmx.l.google.com at priority 10), while calling delivery_check in 590 ms auto-discovered active 1,024-bit DKIM keys on selectors google, s1 and s2. You can run the same check in a browser on the free SPF, DKIM and DMARC checker page, browse common questions on Domain Mail Check answers, or order a turnkey DNS remediation package on Mailfix.

Step 1: Check SPF lookup count, DMARC policy and DKIM selectors with check_email_auth

Pass your domain and any known DKIM selector names (up to 5 selectors, such as "google" for Google Workspace or "selector1" for Microsoft 365) to check_email_auth on https://mailcheck.openkrill.app/mcp:

{"method":"tools/call","params":{"name":"check_email_auth","arguments":{"domain":"stripe.com","dkim_selectors":["google"]}}}

In 1,558 ms (1,077 ms without the DKIM selector probe), check_email_auth returned:

  • Spoofing grade: A (SPF with -all or ~all plus DMARC p=quarantine or p=reject at pct=100 with a rua report address).
  • SPF record and recursive lookup count: v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all. The two ip4 literals cost 0 DNS queries, while resolving the three include: trees takes 7 total DNS lookups, staying 3 lookups inside RFC 7208's ceiling of 10.
  • DMARC policy: v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com; at _dmarc.stripe.com (policy: "reject", pct: 100, issues: []).
  • DKIM selector verification: dkim.status: "found" with selector: "google", found: true.
  • MX records and provider detection: 5 MX records pointing to Google Workspace (aspmx.l.google.com at priority 10, alt1.aspmx.l.google.com and alt2.aspmx.l.google.com at priority 20, and aspmx2.googlemail.com and aspmx3.googlemail.com at priority 30).

Step 2: Check Gmail, Yahoo and Outlook bulk-sender rules with delivery_check

To test whether Gmail and Outlook will likely accept mail from a domain under their current bulk-sender requirements, call delivery_check:

{"method":"tools/call","params":{"name":"delivery_check","arguments":{"domain":"stripe.com"}}}

In 590 ms, delivery_check returned verdict: "likely_accepted" for both Gmail and Outlook, passing all 8 domain-level rules (3 IP-specific rules are skipped when no sending_ip argument is supplied): valid SPF (7 of 10 lookups), published DKIM keys (auto-discovered at selectors google, s1 and s2, each estimated at 1,024 bits), published DMARC (p=reject), From-domain alignment, MX reply capability, and a clean domain check against the NordSpam domain blocklist (dbl.nordspam.com).

How 4 DNS and DMARC tools compared on stripe.com

We ran the same stripe.com check across 4 tools on 2026-10-20 (see also our email DNS check tools comparison):

ToolResult on stripe.comWall timeSetupScore
OpenKrill Domain Mail Check (check_email_auth)Grade A, DMARC p=reject (pct=100, rua), SPF ~all with 7 DNS lookups, 5 MX hosts, Google Workspace detected, plus a shareable web report URL1,077 msNone (web page or remote MCP)9.0 / 10
IntoDNS.ai MCP (RoscoNL/intodns-mcp-server)Score 95; DMARC reject at pct=100, SPF 7 lookups with full lookup tree and blacklist check8,925 ms (5,967 ms npx startup + 2,958 ms call)Local npx package install8.8 / 10
checkdmarc (domainaware/checkdmarc Python CLI)DMARC reject and valid SPF with 7 lookups and parsed tree, but required a local Python environment and slow local DNS resolution17,187 ms (including uvx setup)Local Python CLI install8.4 / 10
MxToolbox SuperTool (mxtoolbox.com/SuperTool.aspx)Not run: initial HTML states JavaScript is required and returns no DNS results without a browser sessionnot runInteractive browser requirednot run

During our 06:18 UTC benchmark run, check_email_auth scored 8/10 on quality (9.0 overall) because records_to_paste still included a redundant "later" replacement line on a domain already at p=reject. That defect was fixed on the same day, and our 09:43 UTC re-run above confirmed records_to_paste: [] and fixes: [] on stripe.com.

How to connect Domain Mail Check in your AI client

Connect https://mailcheck.openkrill.app/mcp directly, or follow the install guides for Domain Mail Check in ChatGPT, Domain Mail Check in Claude, Domain Mail Check in Cursor and Domain Mail Check in Pi.

Frequently asked questions

Does stripe.com have a DMARC record, and is its policy reject or quarantine?

Yes. As of 2026-10-20, _dmarc.stripe.com publishes v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;. Its policy is reject across 100 percent of messages, instructing receiving mail servers to block unaligned messages outright rather than quarantining them to spam.

How do I check if my domain's SPF record goes over the 10 DNS lookup limit?

Run your domain on tools.openkrill.app/spf-dkim-dmarc-check or call check_email_auth on https://mailcheck.openkrill.app/mcp. The tool recursively follows every include, redirect, a, mx, ptr and exists mechanism in your v=spf1 record and reports the total DNS lookup count in spf.lookups against the RFC 7208 limit of 10.

What is a free tool to check SPF, DKIM and DMARC for a domain?

OpenKrill's Domain Mail Check is free and requires no account or API key, both on the web at tools.openkrill.app/spf-dkim-dmarc-check and over MCP at https://mailcheck.openkrill.app/mcp (up to 60 calls a minute per network). It includes 5 tools: check_email_auth, delivery_check, launch_score, check_dns_records and lookup_domain_registration.

Why does check_email_auth report DKIM as unknown when I only pass a domain?

Unlike SPF and DMARC, which live at fixed DNS names (@ and _dmarc), DKIM public keys sit under selector._domainkey.domain, and DNS does not allow listing every selector without knowing its name. Pass dkim_selectors (such as ["google"] or ["selector1"]) to check_email_auth, or call delivery_check, which automatically probes 10 common selectors (default, google, selector1, selector2, k1, k2, s1, s2, dkim and mail).

Sources