Check SPF, DKIM and DMARC

Enter your domain to review the three records that decide whether your email reaches the inbox or ends up in spam.

How to check your email authentication

Enter the domain you send email from (the part after the @).
If you know your DKIM selector, enter it; otherwise leave it empty and we will try those of the most common providers.
Review the three sections: each warning explains what is wrong and how to fix it in your domain's DNS.

SPF, DKIM and DMARC in two minutes

Email does not check by itself who sends it: anyone can put whatever they want in the sender field. To prevent spoofing (phishing) and spam, mail servers look up three TXT records of the domain:

SPF: the list of servers allowed to send the domain's email.
DKIM: a cryptographic signature on every message, checked against a public key published in DNS.
DMARC: the policy that ties the other two together. It says what to do when a message passes neither SPF nor DKIM aligned with the sender (let it through, send it to spam or reject it) and where to send reports.

Without all three, your emails are much more likely to end up in the spam folder, and anyone can send fake emails in your name.

Why they are now mandatory

Since 2024, Gmail and Yahoo require SPF, DKIM and DMARC from anyone sending more than 5,000 emails a day to their users, and Microsoft has applied the same rules on Outlook.com since 2025. For small senders they are not strictly mandatory, but without them the domain's reputation drops and filters get much tougher.

On top of that, DMARC with a «quarantine» or «reject» policy is required to show your logo next to your emails (BIMI) and is increasingly demanded by security audits and cyber insurance.

Most common mistakes

Two SPF records: when adding a new provider, a second record is created instead of adding an include to the existing one. With two, SPF fails completely.
More than 10 DNS lookups: every include, a, mx or exists counts, including those inside includes. With many providers the limit is exceeded without anyone noticing.
«+all» at the end: it authorizes everyone and voids SPF.
DMARC stuck on «p=none»: it is monitoring mode, useful at first, but it does not protect.
DKIM not enabled at the provider: many (Google Workspace, Microsoft 365) require turning it on manually and publishing the key.
1024-bit DKIM keys: they still work, but you should rotate them to 2048.

How to reach DMARC «reject» without losing email

The safe order is:

Publish SPF with all your sending services (your mailbox, the website, the CRM, the newsletter tool) ending in «~all».
Enable DKIM on every service that sends on your behalf.
Publish DMARC with «p=none» and an rua address to receive reports.
For a few weeks, review the reports and add the legitimate services that fail to SPF or DKIM.
Move to «p=quarantine» (you can start with pct=25 and work up) and, once everything is clean, to «p=reject».

Come back to this tool after every change to check that the records are still valid.

Each record in detail

SPF checkWhich servers may send the domain's email and whether the record exceeds 10 lookups.DKIM checkWhether the domain's emails are signed and with what key size.DMARC checkThe domain's anti-spoofing policy and where its reports go.

Frequently asked questions

What is my DKIM selector?

Open an email you sent, view its source or original headers and look for DKIM-Signature: the «s=» value is the selector and «d=» the domain. Google Workspace usually uses «google» and Microsoft 365 «selector1» and «selector2».

Is «~all» or «-all» better?

With DMARC in place the practical difference is small, because the DMARC policy decides. «-all» is stricter; «~all» is more forgiving with forwarding and forgotten services. Without DMARC, «-all» protects more.

I changed my DNS and the tool does not see it. Why?

DNS records are cached for as long as their TTL says (often one hour). Wait that long and check again. Also make sure the record is on the right name (for example, _dmarc.yourdomain.com for DMARC).

Do I need SPF and DMARC on a domain that sends no email?

Yes, it is highly recommended: publish «v=spf1 -all» and «v=DMARC1; p=reject;» so nobody can use that domain to send fake emails.

Do you store the domains I check?

No. We query public DNS at that moment, with our own resolver, and store neither the domain nor the result.