Free tool

Check your SPF, DKIM and DMARC records

Enter a domain to see what passes, what fails, and the exact record to fix it. Includes the Gmail and Yahoo bulk sender requirements.

What this checks

Three records that prove mail is yours, and one that receives it

SPF

A TXT record on your domain that lists the servers allowed to send mail for it. We check there is exactly one, expand every include, and count DNS lookups against the limit of 10. Going past 10 is the most common way a working record breaks when a team adds one more tool.

DKIM

A public key in DNS that receivers use to check each message’s signature. We try about 30 selectors that common providers use, follow CNAMEs to wherever the key is hosted, and read its length: 2048 bits is the standard, 1024 still works, and anything shorter is rejected.

DMARC

A TXT record at _dmarc on your domain that tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports. We check the policy, every tag, and that any outside report address has agreed to take your reports.

MX

Where mail for your domain is delivered. It is not part of authentication, but replies, bounces and DMARC reports need somewhere to land.

For the longer version, with an example of alignment and the order to set things up in, read SPF, DKIM and DMARC explained for founders.

Gmail and Yahoo

What Gmail and Yahoo require

Since February 2024, Gmail and Yahoo hold anyone who sends them a lot of mail to a set of rules. Gmail counts a bulk sender as anyone who has sent more than 5,000 messages a day to Gmail addresses, and once you are one, you stay one. Bulk senders need:

  • SPF and DKIM, both set up for the sending domain.
  • A DMARC record. p=none meets the rule.
  • The From address aligned with SPF or DKIM, so DMARC passes.
  • One-click unsubscribe on marketing mail, honored within two days.
  • A spam complaint rate below 0.3%, and ideally below 0.1%.

Everyone else still needs SPF or DKIM. Microsoft applies similar rules to Outlook.com. This checker grades the parts DNS can show; the report lists the rest.

Common failures

How to fix what this finds

More than one SPF record

Receivers treat two v=spf1 records as an error, so SPF fails for both. Merge every include: into one record and delete the others. The checker writes the merged record for you.

Too many SPF lookups

Open the include tree in the report to see what is spending your 10 lookups. Remove services you stopped using, and move bulk mail to a subdomain like mail.yourdomain.com with its own short record.

No DMARC record

Add a TXT record at _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:[email protected], and create that mailbox. It changes nothing about delivery and starts the reports.

DKIM key not found

Find the selector in a sent message’s DKIM-Signature header (s=) and enter it above. If your platform gave you CNAME records, check each one is in DNS exactly as given, with no doubled domain at the end.

A 1024-bit DKIM key

It still works, but 2048 bits is the standard. Most platforms rotate to a 2048-bit key from their domain settings, sometimes under a new selector.

DMARC stuck at p=none

Monitoring forever protects nothing. Once your reports show every service that sends as you passing, move to p=quarantine, then p=reject.

Setting up a domain to send from Pombo? Verify your sending domain lists every record and what it is for.

Questions

Frequently asked questions

Is this checker free?
Yes, with no signup and no email address. It reads public DNS records, the same ones every mail server reads, and nothing else.
Why can’t it find my DKIM key?
A DKIM key lives at a name made from a selector, like s1._domainkey.yourdomain.com, and DNS has no way to list them. We try about 30 selectors that common providers use. Many platforms, Amazon SES among them, use a random selector per domain, so we cannot guess it. Open an email you sent, view the original message, and find s= in the DKIM-Signature header. Enter that value as the selector.
What is the SPF 10 lookup limit?
Receivers stop evaluating an SPF record after 10 DNS lookups. Every include:, a, mx, exists and redirect= costs one, and so does everything inside each include. Past 10, SPF fails for every message, not just the last service you added. Remove includes for tools you no longer use, or send from a subdomain with its own record.
Should my SPF record end in ~all or -all?
Either is fine once DMARC is enforcing. ~all (soft fail) is the common choice, because DMARC decides what happens to failing mail anyway. -all is stricter. Never use +all, which lets anyone send as you, and avoid ?all, which says nothing.
Which DMARC policy should I use?
Start at p=none with a report address, so nothing changes about delivery while you learn who sends as you. Read the reports for a few weeks. When every service you use passes, move to p=quarantine, then to p=reject. A subdomain that only your email platform sends from can start stricter.
Do I need DMARC if I don’t send bulk email?
Gmail and Yahoo only require it from bulk senders, but it is the one record that stops other people sending mail as your domain, and the reports show you every service sending for you. It costs one TXT record.
I fixed a record. Why does the checker still show the old one?
DNS answers are cached for the record’s TTL, often an hour, and we keep each result here for five minutes. Most changes show up within minutes. If an hour has passed, check that you edited the zone your domain actually uses.
If everything passes, will my email reach the inbox?
Not on its own. Authentication proves the mail is yours. Where it lands depends on what you send, who you send it to, and how they respond. Deliverability basics covers the rest.