Free tool · email authentication
SPF, DKIM & DMARC Checker
Enter a domain to check the three records that prove its email is genuine. You’ll see what’s set up, what’s broken and the exact record to publish to fix it.
What SPF, DKIM and DMARC do
Anyone can put your address in the From line of an email. These three DNS records are how receiving servers tell genuine mail from forgeries, and how your own mail avoids the spam folder.
| Record | Where it lives | What it proves |
|---|---|---|
| SPF | TXT at the domain | The sending server is on the domain’s list of approved senders. |
| DKIM | TXT (or CNAME) at selector._domainkey | The message was signed by the domain and not changed in transit. |
| DMARC | TXT at _dmarc | The From domain matches what SPF or DKIM verified, and what to do when it doesn’t. |
SPF and DKIM each check a domain, but not necessarily the one your reader sees. DMARC ties them to the visible From address: a message passes DMARC when SPF or DKIM passes for a domain that matches it.
Who requires them
Since February 2024, Gmail requires every sender to set up SPF or DKIM. Anyone sending 5,000 or more messages a day to Gmail addresses needs SPF, DKIM and DMARC, with the From domain aligned to SPF or DKIM; a DMARC policy of p=none is enough to meet the rule. Yahoo publishes the same requirements, and both ask every sender to keep the reported spam rate below 0.3%.
Gmail also requires DKIM keys of at least 1,024 bits. Without these records, mail is more likely to be rejected or filed as spam, even when everything else about it is fine.
What this checker looks at
- SPF: that there is exactly one record, every term is valid, it ends with
~allor-all, and the total DNS lookups — including those inside everyinclude:— stay within the limit of 10. - DKIM: the public key at your selector (or at the selectors major services use), whether it’s valid, its length, and whether it’s revoked or in test mode.
- DMARC: the record at
_dmarc(or, for a subdomain, its parent’s), the policy that applies, test mode, alignment settings, and whether report addresses will actually receive reports. - MX, MTA-STS and TLS-RPT: who receives the domain’s mail, and whether it publishes the optional records that secure delivery to it.
Every problem comes with the record to publish or the setting to change. When we can tell from the MX records that the domain uses Google Workspace or Microsoft 365, the suggestion uses that provider’s published values.
Reading your result
- Pass: the record exists and is set up correctly.
- Needs attention: it works, but something weakens it — a
p=nonepolicy, no report address, or SPF close to the lookup limit. - Fail or Missing: receivers will treat it as absent or broken.
- Couldn’t check: the domain’s DNS didn’t answer in time. That’s not the same as a missing record; try again in a minute.
DNS changes can take a while to reach everyone. We cache answers for only a few minutes, so a fix you just published will show up here soon after your DNS host serves it.
Questions
Do I need all three: SPF, DKIM and DMARC?
For reliable delivery, yes. SPF and DKIM authenticate the sender; DMARC connects them to your From address and tells receivers what to do with forgeries. Gmail and Yahoo require all three from anyone sending 5,000 or more messages a day.
Is p=none enough?
It meets Gmail’s and Yahoo’s minimum for bulk senders and gets you reports, but it doesn’t stop anyone spoofing your domain. Once reports show your own mail passes, move to p=quarantine and then p=reject.
Why does DKIM show “not found” when it’s set up?
DKIM keys live under a selector the sending service chooses, and there’s no way to list them. Find the s= value in the DKIM-Signature header of a message you sent, enter it as the selector, and check again.
How long do DNS changes take to show up?
Usually minutes, sometimes up to the record’s TTL or longer with some DNS hosts. This tool caches answers for at most five minutes.
Does this tool send an email or store my domain?
No. It reads public DNS records only and doesn’t keep a list of domains checked.
Sources
More free tools
Check something else
Setup guides