SPF, DKIM & DMARC Checker
Check your email authentication: SPF, DKIM and DMARC records, with fixes you can copy.
About the SPF, DKIM & DMARC Checker
SPF, DKIM and DMARC are three DNS records that prove email really comes from your domain. Without them, scammers can send email that looks like it is from you, and your own messages are more likely to land in spam. Since 2024 Gmail, Yahoo and Microsoft require them for anyone sending email in bulk.
This checker reads all three and tells you, in plain language, what is wrong and how to fix it: whether your SPF record is valid and stays within the limit of 10 DNS lookups, whether it ends with a protective ~all or -all, whether a DKIM key is published and strong enough (it tries the selectors used by Google Workspace, Microsoft 365, Zoho, Hostinger, Mailchimp and other services, or the one you enter), and how strict your DMARC policy is. It also checks MTA-STS, TLS-RPT and BIMI, recognises your email provider, and suggests records you can paste straight into your DNS settings.
Frequently asked questions
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send email for your domain. DKIM adds a digital signature to each message. DMARC tells receivers what to do when a message fails both checks, and sends you reports about it.
Why is my DKIM record not found?
DKIM keys live under a “selector” chosen by your email service. If yours is not one of the common ones, open an email you sent, view the original message and look for s= in the DKIM-Signature header, then enter that selector.
What does “too many DNS lookups” mean?
SPF may use at most 10 DNS lookups (include, a, mx, ptr, exists and redirect). Above that, receivers treat SPF as broken. Remove services you no longer use or replace includes with ip4 ranges.
Should I use p=reject right away?
No. Start with p=none and read the reports for a few weeks so you find every service that sends email for you. Then move to p=quarantine and finally p=reject.