SPF, DKIM and DMARC checker.
Find out why your emails land in spam. We check the three DNS records that prove your mail is really from you: SPF (which servers may send it), DKIM (a digital signature) and DMARC (what to do with mail that fails). Then generate a DMARC record if you need one.
- Free, no sign-up
- We check public information only. How your data is handled
DMARC record generator
No DMARC record yet? Build one here, then add it as a TXT record named _dmarc at your DNS provider.
How to use the SPF, DKIM & DMARC Checker
- Enter your domain: the part after the @ in your email address.
- Optionally add your DKIM selector. If you don't know it, we try the common ones.
- Read each section: red items stop email being trusted, amber ones are improvements.
- Use the DMARC generator below the results if you don't have a DMARC record yet.
Why these three records decide whether you reach the inbox
Anyone can put your address in the "From" line of an email. SPF, DKIM and DMARC are how receiving servers tell real mail from fakes. Since 2024, Gmail and Yahoo require bulk senders to have all three, and even small senders without them see more mail filtered to spam.
- SPF: a TXT record listing the servers allowed to send mail for your domain. There must be exactly one, using no more than 10 DNS lookups.
- DKIM: a public key in DNS that matches a signature your email provider adds to every message, proving it wasn't altered.
- DMARC: tells receivers what to do when SPF or DKIM fails (nothing, spam folder or reject) and where to send reports.
Finding your DKIM selector
DKIM records sit at a name like selector._domainkey.yourdomain.com, and the selector is chosen by your email provider. Google Workspace uses "google" by default and Microsoft 365 uses "selector1" and "selector2". To find yours for certain, open an email you sent, view the original message or headers, and look for "s=" in the DKIM-Signature line.
Rolling out DMARC safely
- Start with p=none and a rua address. Nothing is blocked; you just receive reports.
- Read the reports for two to four weeks and add any legitimate senders you missed (newsletter tools, invoicing software, your website's contact form) to SPF and DKIM.
- Move to p=quarantine, so failing mail goes to spam.
- When the reports are clean, move to p=reject for full protection against spoofing.
Common causes of failing email authentication
Two SPF records instead of one, often added by two different providers. Too many includes, pushing SPF past 10 lookups. A website contact form sending as your domain from a server not listed in SPF. DKIM switched off in the email provider's settings. If you send newsletters, our email marketing service sets this up as part of the work.
About the SPF, DKIM & DMARC Checker.
Do I need SPF, DKIM and DMARC for a small business?
Yes. Even at low volumes, mail without them is more likely to be filtered, and without DMARC anyone can send fake email in your name.
Can I have two SPF records?
No. Two or more make SPF fail completely. Merge them into one record with several include: parts.
Why can't the checker find my DKIM record?
Your provider probably uses a selector we didn't try. Find it in a sent email's headers (s= in the DKIM-Signature line) and enter it.
Will p=reject block my own email?
It can, if some of your senders aren't covered by SPF or DKIM. That is why you start at p=none and read the reports first.
Where do I add these records?
At whoever runs your DNS: your domain registrar, your hosting control panel (such as cPanel's Zone Editor) or Cloudflare.
You might also need these.
Email Blacklist Checker
Check whether a domain or mail server IP is on Spamhaus, SpamCop, Barracuda and other spam blacklists.
Use the toolDomain Health Checker
One report on a domain's DNS, website, SSL, email authentication and blacklist status.
Use the toolDNS Lookup
Look up a domain's A, AAAA, CNAME, MX, NS, TXT and SOA records, with TTLs.
Use the toolWant this done for you?
Free tools show you what to fix. We fix it, measure it, and keep it working while you run the business.