SPF, DKIM and DMARC checker for your domain

SPF lists the servers allowed to send email for your domain. DKIM adds a signature that receiving servers can verify. DMARC tells receivers what to do when a message fails both, and sends you reports about who is using your domain. Together they let Gmail, Outlook and Yahoo confirm that mail claiming to come from you really did.

Yes. There is no signup or payment to run a check. If you ask for the report by email, we use your address to send it and for any boxes you tick.

It reads public DNS records for the domain you enter: SPF and DMARC records, DKIM keys at common selector names, and MX records to identify your mail provider. It does not send test messages, so it cannot show whether a particular email was signed. For that, send yourself a message and look for dkim=pass in the headers.

Authentication is the first thing to rule out. A missing or duplicated SPF record, no DKIM signature or no DMARC record are common causes, and Google, Yahoo and Microsoft now expect all three from bulk senders. If the check looks healthy, sender reputation, message content and list quality are the next places to look.

The check shows whether your domain is set up to resist spoofing, not whether someone is spoofing it right now. A DMARC policy of quarantine or reject tells receivers to act on forged mail, and DMARC reports (the rua address) show who is sending as your domain.

The score is out of 100 and graded A to F. A domain with SPF, a 2048-bit DKIM key, a quarantine policy and DMARC reporting scores 95, which is a sound setup. Reject earns the remaining points, but moving there is optional and best done once your reports are clean. When DKIM cannot be verified it is left out, and the grade is based on SPF and DMARC.

DKIM selector names are chosen by whoever sends the mail, and DNS cannot list them. We try the names Google, Microsoft 365, Proton and common sending services document. If yours uses another name, nothing shows up. We leave DKIM out of the score instead of marking it down. If you know your selector, enter it under Advanced and check again.

The check is built to look up public DNS records and return the result, not to keep a list of the domains people test. We cannot promise that nothing is recorded, though: our hosting and analytics services may capture standard visit data such as IP address, time and page address, and a link that includes your domain shows it in that address. If you ask for an emailed report, we use your email address and domain to send it. Our privacy policy describes what we collect.

Yes. It reads your MX records to recognise Google Workspace, Microsoft 365, Proton Mail and Zoho Mail, then names the right provider in the fixes. Other providers get the same checks with generic steps.

SPF (RFC 7208) allows a single record per domain. With two, receiving servers report an error and ignore both. The usual cause is adding a second record when connecting a new email service instead of adding that service to the existing one.

No. Authentication proves who sent a message. It does not control sender reputation, content or recipient filtering. It is the foundation those other things build on.

DNS answers are cached for the record’s time to live, which can be minutes or several hours. Wait a little and run the check again. If it still shows the old record, confirm you edited DNS at the provider that actually hosts your domain’s name servers.