[Agent Tools](https://tools.openkrill.app/) / [Blog](https://tools.openkrill.app/blog)

# How to check a domain's DMARC policy, DKIM keys and the 10-lookup SPF limit: stripe.com across 4 tools

Under RFC 7208 section 4.6.4, a receiving mail server stops evaluating your Sender Policy Framework (SPF) record and returns a permanent error (`permerror`) the moment your `include`, `a`, `mx`, `ptr`, `exists` and `redirect` mechanisms exceed **10 DNS lookups**. We tested `stripe.com` across 4 email-authentication tools to compare DMARC policy inspection, recursive SPF lookup counting, DKIM selector checks and Gmail and Outlook sender-rule verification.

By OpenKrill. Published 2026-10-20. Every DNS record, lookup count and response time below comes from live calls to [Domain Mail Check](https://tools.openkrill.app/tools/mailcheck) (`https://mailcheck.openkrill.app/mcp`) and Cloudflare and Google DNS over HTTPS on 2026-10-20 between 06:18 and 09:43 UTC.

## The short answer

On 2026-10-20, calling `check_email_auth` on `stripe.com` returned spoofing protection **grade A** in 1,077 ms (and confirmed selector `google` in 1,558 ms when passed `dkim_selectors: ["google"]`): `stripe.com` publishes a strict **DMARC `p=reject`** policy at `pct=100` with aggregate reporting to `mailto:dmarc-reports@stripe.com`, a single **SPF `~all` (softfail)** record that consumes **7 of the 10 allowed DNS lookups** across `spf1.stripe.com`, `greenhouse-outbound-mail.stripe.com` and `_spf.qualtrics.com`, and 5 Google Workspace MX hosts (led by `aspmx.l.google.com` at priority 10), while calling `delivery_check` in 590 ms auto-discovered active 1,024-bit DKIM keys on selectors `google`, `s1` and `s2`. You can run the same check in a browser on the [free SPF, DKIM and DMARC checker page](https://tools.openkrill.app/spf-dkim-dmarc-check), browse common questions on [Domain Mail Check answers](https://tools.openkrill.app/answers/mailcheck), or order a turnkey DNS remediation package on [Mailfix](https://tools.openkrill.app/mailfix).

## Step 1: Check SPF lookup count, DMARC policy and DKIM selectors with check_email_auth

Pass your domain and any known DKIM selector names (up to 5 selectors, such as `"google"` for Google Workspace or `"selector1"` for Microsoft 365) to `check_email_auth` on `https://mailcheck.openkrill.app/mcp`:

```
{"method":"tools/call","params":{"name":"check_email_auth","arguments":{"domain":"stripe.com","dkim_selectors":["google"]}}}
```

In 1,558 ms (1,077 ms without the DKIM selector probe), `check_email_auth` returned:

- **Spoofing grade:** `A` (SPF with `-all` or `~all` plus DMARC `p=quarantine` or `p=reject` at `pct=100` with a `rua` report address).
- **SPF record and recursive lookup count:** `v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all`. The two `ip4` literals cost 0 DNS queries, while resolving the three `include:` trees takes **7 total DNS lookups**, staying 3 lookups inside RFC 7208's ceiling of 10.
- **DMARC policy:** `v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;` at `_dmarc.stripe.com` (`policy: "reject"`, `pct: 100`, `issues: []`).
- **DKIM selector verification:** `dkim.status: "found"` with `selector: "google", found: true`.
- **MX records and provider detection:** 5 MX records pointing to Google Workspace (`aspmx.l.google.com` at priority 10, `alt1.aspmx.l.google.com` and `alt2.aspmx.l.google.com` at priority 20, and `aspmx2.googlemail.com` and `aspmx3.googlemail.com` at priority 30).

## Step 2: Check Gmail, Yahoo and Outlook bulk-sender rules with delivery_check

To test whether Gmail and Outlook will likely accept mail from a domain under their current bulk-sender requirements, call `delivery_check`:

```
{"method":"tools/call","params":{"name":"delivery_check","arguments":{"domain":"stripe.com"}}}
```

In 590 ms, `delivery_check` returned `verdict: "likely_accepted"` for both Gmail and Outlook, passing all 8 domain-level rules (3 IP-specific rules are skipped when no `sending_ip` argument is supplied): valid SPF (7 of 10 lookups), published DKIM keys (auto-discovered at selectors `google`, `s1` and `s2`, each estimated at 1,024 bits), published DMARC (`p=reject`), From-domain alignment, MX reply capability, and a clean domain check against the NordSpam domain blocklist (`dbl.nordspam.com`).

## How 4 DNS and DMARC tools compared on stripe.com

We ran the same `stripe.com` check across 4 tools on 2026-10-20 (see also our [email DNS check tools comparison](https://tools.openkrill.app/compare/email-dns-check-tools)):

| Tool | Result on stripe.com | Wall time | Setup | Score |
| --- | --- | --- | --- | --- |
| **OpenKrill Domain Mail Check** (`check_email_auth`) | Grade A, DMARC `p=reject` (`pct=100`, `rua`), SPF `~all` with 7 DNS lookups, 5 MX hosts, Google Workspace detected, plus a shareable web report URL | 1,077 ms | None (web page or remote MCP) | 9.0 / 10 |
| **IntoDNS.ai MCP** (`RoscoNL/intodns-mcp-server`) | Score 95; DMARC `reject` at `pct=100`, SPF 7 lookups with full lookup tree and blacklist check | 8,925 ms (5,967 ms `npx` startup + 2,958 ms call) | Local `npx` package install | 8.8 / 10 |
| **checkdmarc** (`domainaware/checkdmarc` Python CLI) | DMARC `reject` and valid SPF with 7 lookups and parsed tree, but required a local Python environment and slow local DNS resolution | 17,187 ms (including `uvx` setup) | Local Python CLI install | 8.4 / 10 |
| **MxToolbox SuperTool** (`mxtoolbox.com/SuperTool.aspx`) | Not run: initial HTML states JavaScript is required and returns no DNS results without a browser session | not run | Interactive browser required | not run |

During our 06:18 UTC benchmark run, `check_email_auth` scored 8/10 on quality (9.0 overall) because `records_to_paste` still included a redundant "later" replacement line on a domain already at `p=reject`. That defect was fixed on the same day, and our 09:43 UTC re-run above confirmed `records_to_paste: []` and `fixes: []` on `stripe.com`.

## How to connect Domain Mail Check in your AI client

Connect `https://mailcheck.openkrill.app/mcp` directly, or follow the install guides for [Domain Mail Check in ChatGPT](https://tools.openkrill.app/integrations/mailcheck/chatgpt), [Domain Mail Check in Claude](https://tools.openkrill.app/integrations/mailcheck/claude), [Domain Mail Check in Cursor](https://tools.openkrill.app/integrations/mailcheck/cursor) and [Domain Mail Check in Pi](https://tools.openkrill.app/integrations/mailcheck/pi).

## Frequently asked questions

### Does stripe.com have a DMARC record, and is its policy reject or quarantine?

Yes. As of 2026-10-20, _dmarc.stripe.com publishes v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;. Its policy is reject across 100 percent of messages, instructing receiving mail servers to block unaligned messages outright rather than quarantining them to spam.

### How do I check if my domain's SPF record goes over the 10 DNS lookup limit?

Run your domain on tools.openkrill.app/spf-dkim-dmarc-check or call check_email_auth on https://mailcheck.openkrill.app/mcp. The tool recursively follows every include, redirect, a, mx, ptr and exists mechanism in your v=spf1 record and reports the total DNS lookup count in spf.lookups against the RFC 7208 limit of 10.

### What is a free tool to check SPF, DKIM and DMARC for a domain?

OpenKrill's Domain Mail Check is free and requires no account or API key, both on the web at tools.openkrill.app/spf-dkim-dmarc-check and over MCP at https://mailcheck.openkrill.app/mcp (up to 60 calls a minute per network). It includes 5 tools: check_email_auth, delivery_check, launch_score, check_dns_records and lookup_domain_registration.

### Why does check_email_auth report DKIM as unknown when I only pass a domain?

Unlike SPF and DMARC, which live at fixed DNS names (@ and _dmarc), DKIM public keys sit under selector._domainkey.domain, and DNS does not allow listing every selector without knowing its name. Pass dkim_selectors (such as ["google"] or ["selector1"]) to check_email_auth, or call delivery_check, which automatically probes 10 common selectors (default, google, selector1, selector2, k1, k2, s1, s2, dkim and mail).

## Sources

- SPF, DKIM, DMARC and delivery check runs on `stripe.com`: [Domain Mail Check MCP server](https://tools.openkrill.app/tools/mailcheck) (`https://mailcheck.openkrill.app/mcp`) and [web checker](https://tools.openkrill.app/spf-dkim-dmarc-check), recorded on 2026-10-20 between 06:18 and 09:43 UTC.
- SPF 10-lookup specification: [IETF RFC 7208 Section 4.6.4 (DNS Lookup Limits)](https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4).
- Bulk sender requirements: [Google Workspace Email Sender Guidelines](https://support.google.com/a/answer/81126), [Yahoo Sender Best Practices](https://senders.yahooinc.com/best-practices/) and [Microsoft Outlook High-Volume Sender Requirements](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730).
- Rival benchmarks: [IntoDNS.ai MCP Server](https://github.com/RoscoNL/intodns-mcp-server) and [checkdmarc](https://github.com/domainaware/checkdmarc), tested on 2026-10-20.