SPF, DKIM & DMARC Checker
Check a domain's email authentication: SPF, DKIM and DMARC records, with fixes for what is missing
Result
Enter a domain to check its email authentication.
SPF
Which servers may send mail for the domain.
DKIM
Signatures that prove a message was not altered.
DMARC
What receivers do with mail that fails the checks.
About SPF, DKIM & DMARC Checker
This checker reads the three records that decide whether mail from a domain is trusted: SPF, DKIM and DMARC. One domain, one check, all three answers, each with a pass, a warning or a failure and the reason in plain words.
It catches the mistakes that quietly send mail to spam: an SPF record over the 10-lookup limit, a second SPF record, a 1024-bit DKIM key or a DMARC policy that blocks nothing.
When DMARC is missing you get a starting record to copy, and the mail provider of the domain is recognised from its mail servers.
Key Features
- All three in one run: SPF, DKIM and DMARC are checked together, with an overall score.
- SPF lookup count: includes are followed to count every DNS lookup against the limit of 10, the most common hidden SPF failure.
- DKIM without knowing the selector: the names used by the major mail services are tried for you; you can also enter your own.
- Key strength: the length of each DKIM key is shown, with a warning for keys under 2048 bits.
- DMARC policy review: policy, coverage and report address are explained, with a suggested record when none exists.
- Mail provider: Google Workspace, Microsoft 365, Zoho and others are recognised from the mail servers.
How to Use
- Enter a domain: the part after the @ in the email address, such as example.com.
- Add a selector if you know it: optional; it is the s= value in the DKIM-Signature header of a sent message.
- Press Check: all three records are read in a few seconds.
- Read each card: green is fine, amber needs attention, red is broken or missing.
- Fix and recheck: copy a suggested record into your DNS, wait for it to publish and run the check again.
Common Use Cases
- Mail going to spam: find the missing or broken record behind it.
- Bulk sender rules: confirm SPF, DKIM and DMARC are in place before sending to large mailbox providers.
- After switching mail provider: make sure the old provider is removed from SPF and the new one signs with DKIM.
- Spoofing protection: see whether someone could send convincing fake mail as your domain.
- Client and vendor audits: check a partner's domain before trusting mail that claims to come from it.
Frequently Asked Questions
What do SPF, DKIM and DMARC do?
SPF lists the servers allowed to send mail for a domain. DKIM adds a signature that proves a message was not changed. DMARC tells receivers what to do when a message fails those checks and where to send reports.
Why does SPF fail with too many lookups?
Receivers stop after 10 DNS lookups while reading an SPF record and its includes. Every include, a and mx counts, and includes of includes count too. Past the limit, SPF fails for every message.
Why is no DKIM key found?
DKIM keys live under a selector name chosen by the mail service. If yours is not one of the common names, open the headers of a message you sent and enter the s= value from the DKIM-Signature line.
Which DMARC policy should I use?
Start with p=none and a report address, read the reports for a few weeks, then move to quarantine and finally reject once all your real senders pass.
How long do DNS changes take to show?
Usually minutes, sometimes up to a few hours depending on the record's time to live. Run the check again after the change has published.
Does a pass guarantee my mail reaches the inbox?
No. These records prove who sent a message; content, sending reputation and complaint rates still decide where it lands.
Pro Tips
- Keep one SPF record: merge all senders into a single record instead of adding a second one.
- Remove old senders: includes for services you no longer use waste lookups and widen who can send as you.
- Rotate DKIM keys: replace keys yearly and remove old selectors once nothing signs with them.
- Read DMARC reports: they show every service sending as your domain, including ones you forgot.
- Protect unused domains: domains that send no mail should publish v=spf1 -all and a reject DMARC policy.