Recommended Free Tools
You can test sender authentication from a script and make required checks fail a CI build. The reliable approach has two layers: verify DNS configuration for the identities your mail actually uses, then send a uniquely identifiable test message and inspect the receiving mailbox’s Authentication-Results header. Passing these checks confirms authentication for the tested message; it cannot guarantee inbox placement with every provider.
What a script can—and cannot—prove
“Deliverability” can mean several different things. A DNS check can confirm that records are published; a received-message test can show how one receiving system evaluated authentication. Neither a successful SMTP submission nor a passing SPF or DKIM check proves that a message landed in the inbox rather than spam. Gmail says authenticated messages are less likely to be rejected or marked as spam, not that authentication guarantees either outcome: Google’s sender guidelines.
As an Amazon Associate I earn from qualifying purchases.
Keep the goal of each test explicit. A DNS-only job checks configuration. A send-and-inspect job checks a specific route through a sender and receiver. A sandbox can validate application flow and message content, but if it routes messages only to its own accounts, it does not test real-recipient inbox placement.
Identify the three domains before checking records
Do not assume the visible From address is the only identity involved. Inspect a real message or your provider’s sending configuration and record the relevant domains and selector.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- SPF: checks whether the sending source is authorized by the policy for the envelope sender (also called the mail-from or return-path) domain.
- DKIM: lets a receiver verify a message signature using a public key published for the signing domain and selector. The selector and signing domain are needed to locate the key.
- DMARC: applies to the visible From domain. It requires an aligned SPF or DKIM authentication result and publishes a policy for receivers. An SPF pass alone does not necessarily mean DMARC passes.
These distinctions follow the protocol definitions in RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC). Google also explains sender authentication requirements and record concepts in its sender guidelines.
Choose what the CI check will observe
| Approach | What it observes | What it exercises | CI considerations |
|---|---|---|---|
| DNS-only checks | Published SPF, DKIM and DMARC configuration for the specified domains. | No message sending or receiver evaluation. | Simple to run without mailbox credentials. Check expected provider configuration, not merely the existence of a TXT record. |
| Send and inspect through your real provider | The authentication verdict in a message received by a mailbox you control. | The configured sender path and the receiving system’s evaluation for that message. | Requires appropriately scoped sender credentials and a retrievable test mailbox. Results apply to the tested route and receiver. |
| Hosted email sandbox | Message content and application send flow, with messages retrievable through the sandbox. | The application’s interaction with the sandbox, not necessarily delivery to external inboxes. | Convenient for automated retrieval. SMTP.dev says its sandbox messages are delivered only to sandbox accounts, so this does not establish real-recipient inbox placement: SMTP.dev’s CI guide. |
| Self-hosted analysis platform | Potentially a broader set of message and authentication details, depending on the setup. | A receiving and analysis environment you operate. | More operational work. happyDeliver describes a broad analysis surface and notes that inbound port 25 must be reachable for its receiving setup: happyDeliver’s repository. |
For most teams, DNS checks are a useful fast gate; add a received-message check when you need to validate the actual sending path. A sandbox is a practical option for application-level tests, while a real receiving mailbox is needed to observe a non-sandbox receiver’s verdict.
Build the checks in two layers
1. Check the expected DNS configuration
Resolve the SPF policy for the actual envelope sender domain, the DKIM public key for the signing domain and selector used by your messages, and the DMARC policy for the visible From domain. Compare what you find with the values expected by your sending provider. A record’s mere presence is not enough: the contents must authorize or identify the right sending setup. Provider documentation determines the correct values; the RFCs define protocol behavior, not the provider-specific configuration to paste into DNS.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Make the checker’s inputs visible in its logs: the envelope domain, DKIM signing domain and selector, and From domain. Never print credentials or private DKIM keys. Treat a confirmed missing or invalid required record as a failed assertion. A DNS lookup timeout or resolver error is different from a confirmed bad record; report it as an infrastructure error and apply a bounded retry rather than disguising it as a permanent authentication failure.
2. Send a controlled message and inspect its headers
- Send a test message to a mailbox the team owns, using the sender path you want to validate.
- Give each run a unique subject or message identifier so parallel or scheduled jobs cannot accidentally inspect an older message.
- Retrieve the received message’s raw headers and inspect
Authentication-Resultsfrom the receiving system. - Assert the specific receiver verdicts for SPF, DKIM and DMARC, including DMARC alignment when that is part of your policy.
- Report a temporarily unavailable mailbox or receiver separately from a confirmed authentication failure. Retry only within a defined limit, then return a clear infrastructure-error status.
Use the receiving system’s header results to diagnose the message, rather than treating a successful send API or SMTP response as proof of authentication. Microsoft’s email authentication documentation explains the results and troubleshooting distinctions.
Interpret failures by component
| Observed result | What to check | Likely next action |
|---|---|---|
| SPF fails | Confirm the envelope sender domain the receiver evaluated and whether the actual sending source is authorized by that domain’s SPF policy. | Microsoft’s troubleshooting guidance recommends correcting SPF by adding the sending IP or include when SPF alone fails. |
| DKIM fails or is absent | Check that signing is enabled and that the public key is published for the signing domain and selector present in the message. | Microsoft identifies enabling DKIM and publishing the required DNS records as the relevant fix for a DKIM-only failure. |
| SPF and DKIM pass, but DMARC fails | Compare the authenticated SPF or DKIM domain with the visible From domain; the passing result may not be aligned. | Correct the domain alignment for at least one authentication method. |
| SPF, DKIM and DMARC pass | The tested receiver accepted those authentication checks for this message. | Do not treat that result as a promise of inbox delivery; reputation, content, recipient policy and other receiver signals are outside the assertion. |
| A sandbox retrieves the message | The application produced a message that the sandbox could retrieve. | If the sandbox delivers only to its own accounts, this says nothing conclusive about external inbox placement. |
Microsoft’s authentication overview provides receiver-header context and a troubleshooting matrix. Use the actual evaluated identities from the message when investigating; checking a different domain can produce a misleadingly reassuring DNS result.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Make a failed assertion fail the build
The checker should exit successfully only when every required assertion passes. Return a nonzero status for a confirmed missing or invalid required authentication setup, or when a received message fails the team’s stated aligned-authentication condition. Use distinct, readable output for authentication failures and infrastructure errors so a transient DNS or mailbox outage is not mistaken for a permanent configuration regression.
Run it when email templates, sending configuration, deployment configuration or the checker itself changes. A scheduled run can also detect DNS drift when application code has not changed. GitHub Actions supports event-triggered and scheduled workflows, and its CI documentation describes how test failures appear in pull requests: GitHub Actions continuous integration. GitHub Actions is one option, not a requirement; the same nonzero-exit principle works in other CI systems.
- Store sender and mailbox credentials in the CI platform’s secret store, and expose them only to the workflow that needs them.
- Send automated tests only to controlled mailboxes, never to customers.
- Log the identity and check that failed without logging secrets or private keys.
- Keep retries bounded and label exhausted temporary failures clearly.
SMTP.dev’s example CI workflow demonstrates supplying an API key and sender password as GitHub Actions secrets. Adapt the secret handling to your provider and organization’s controls.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What authentication policy changes mean for your test
Google’s sender guidance identifies 5,000 messages per day as its bulk-sender threshold and says senders at that scope must set up SPF, DKIM and DMARC. That is a Google policy threshold, not a universal protocol rule or a measure of how effective a CI test is; check Google’s live guidance for current scope and requirements: Google’s sender guidelines.
A CI authentication test is valuable because it catches a defined configuration or receiver-verdict regression. The available guidance does not establish a general percentage by which this method improves inbox placement, and a passing test should not be represented as one.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
