🛡️ SPF, DKIM & DMARC Checker

The three records that decide inbox or spam

Forged email is trivial to send, so receivers check three DNS records before trusting a message from your domain. SPF lists the servers allowed to send for you. DKIM attaches a cryptographic signature that proves the message was not altered and really came from an approved sender. DMARC ties them together: it tells receivers what to do when a message fails, and where to send reports about abuse of your domain. This checker reads all three, judges them the way a receiving mail server would, and tells you in plain English what to fix.

The findings that matter most

• SPF lookups over 10, every include, a, mx and redirect costs a DNS lookup, and the standard caps the total at 10. Over the limit, SPF fails completely, which is worse than a weak record.
• DMARC on p=none forever, that is monitoring mode. Fine for the first weeks, but protection only starts at quarantine or reject.
• DKIM on an unexpected selector, DKIM keys hide under a selector name chosen by your mail provider. If our common selectors miss yours, your provider's settings page names it, and you can re-run this check with that selector in the box.

Frequently asked questions

Do I need all three if my mail "works"?

Sending works without them; landing in the inbox is another matter. Since 2024, Google and Yahoo require SPF, DKIM and DMARC for bulk senders, and smaller receivers increasingly follow the same rules. Missing records are now a direct cause of spam-folder delivery.

What order should I fix them in?

SPF first (list your real senders), then DKIM (switch it on in your mail provider and publish the key), then DMARC starting at p=none with a reporting address, moving to quarantine and finally reject once the reports look clean.

Why does my SPF include so many services?

Every tool that sends as your domain needs an include: your mailbox provider, your invoicing app, your newsletter service, your website's contact form. The fix for lookup bloat is usually removing services you no longer use.

Can these records break my email if I edit them wrong?

Yes, which is why you change one thing at a time and re-run this checker after each edit. A typo in SPF can fail every message; DMARC at p=none is the safe way to watch the effect of a change before enforcing it.