SPF, DKIM & DMARC Checker

Find out why your email lands in spam: check SPF, DKIM and DMARC for any domain, with the exact fix.

Checked from our server. We don't store what you enter.

· Checked from our server through public DNS (Cloudflare, or Google if it fails).

Enter a domain to check its email records

You get a score for SPF, DKIM and DMARC, every problem with the steps to fix it, and the full SPF record tree.

How to use SPF, DKIM & DMARC Checker

  1. Type your domain, or any email address at it, and press Check.
  2. Read the three scores first: SPF, DKIM and DMARC. Each problem below comes with the steps to fix it.
  3. If DKIM shows Not found, enter your selector: the s= value in the DKIM-Signature header of an email you sent.
  4. Below the checks, see every record your SPF record includes, the DMARC tags explained and the DKIM keys found.
  5. Copy the report to send to whoever manages your DNS or email.

How it works

Your browser can’t ask DNS servers directly, so the check runs on our server. It asks Cloudflare’s public DNS (1.1.1.1), or Google’s (8.8.8.8) if Cloudflare doesn’t answer, for the domain’s TXT and MX records and its DMARC record at _dmarc. Then it follows every include: and redirect= in the SPF record, and looks for DKIM keys at your selector and at 19 common ones. Only the domain name goes to the DNS services, never your IP address, and nothing is stored.

You can type a domain or any email address at it. Pasting a full record name works too: _dmarc.example.com checks example.com, and google._domainkey.example.com checks example.com with the selector google.

What the three records do

Record Where it lives What it does
SPF A TXT record on the domain, starting with v=spf1 Lists the servers allowed to send mail for the domain.
DKIM A TXT record at selector._domainkey.yourdomain Publishes the key receivers use to check the signature your provider adds to each message.
DMARC A TXT record at _dmarc.yourdomain, starting with v=DMARC1 Tells receivers what to do with mail that fails both: deliver it, send it to spam, or refuse it. It also asks for reports.

Mail passes DMARC when SPF or DKIM passes for the same domain as the From address. Gmail and Yahoo require SPF or DKIM from every sender, and all three from anyone who sends them a lot of mail.

What the checks look for

Check What it tells you
Mail servers Where mail for the domain goes, and which provider runs it (Google Workspace, Microsoft 365 and others).
One SPF record Two or more SPF records break SPF for all your mail.
SPF ending ~all or -all. +all lets anyone send as you; ?all says nothing.
10 DNS lookups Each include:, a, mx, ptr, exists and redirect costs a lookup, counted through every included record. Over 10, SPF fails.
Broken includes An included name that doesn’t exist, has no SPF record, or loops back makes SPF fail.
Your provider in SPF If your mail servers are at a provider, its include: should be in the record.
DKIM keys Whether a key exists at each selector, its size (1024 bits at least, 2048 is better), and whether it’s revoked or cut off.
DMARC policy p=none only reports; p=quarantine and p=reject protect you. Also checks pct, rua and typos in tags.
Subdomains A subdomain without its own DMARC record uses its parent’s policy (sp= if set).

Find your DKIM selector

DKIM keys can live at any name your provider picks, so no checker can list them all. If DKIM shows Not found, look up the selector in a message you sent:

  1. Send an email from your domain to another account you can read, like a Gmail address.
  2. Open the message’s full headers:
    • Gmail: open the message, click More (three dots), then Show original.
    • Outlook on the web: open the message, click More actions (three dots), then View > View message source.
    • Apple Mail: open the message, then View > Message > All Headers.
  3. Find the line that starts with DKIM-Signature. The value after s= is the selector, and the value after d= is the signing domain.
  4. Enter the selector above and check again.

If d= shows your provider’s domain instead of yours, DKIM isn’t set up for your own domain yet. Turn it on in your provider’s admin settings.

Fix too many SPF lookups

  1. Remove include: entries for services that no longer send your mail: an old newsletter tool, a previous host.
  2. Replace a and mx with the ip4: addresses of your own servers. Addresses need no lookup.
  3. Send bulk mail (newsletters, receipts) from a subdomain like news.example.com, with its own SPF record and its own 10 lookups.

Move DMARC from none to reject

  1. Start with v=DMARC1; p=none; rua=mailto:you@yourdomain and read the reports for two to four weeks.
  2. Fix every service of yours that fails: add it to SPF, or turn on DKIM signing in it.
  3. Change to p=quarantine, then, after another few weeks without problems, to p=reject.

A domain that sends no email can skip this: give it v=spf1 -all and v=DMARC1; p=reject; right away, so nobody can send mail as it.

After you change a record

DNS changes reach everyone once the old record’s time to live (TTL) has passed, often within an hour. Check again after a few minutes. If the old record still shows much later, the change didn’t save, or you edited DNS at a provider your domain doesn’t use: the DNS Lookup shows which name servers are really in charge.

Questions

What is a DKIM selector and how do I find mine?

The selector is the name your email provider publishes its DKIM key under, like google in google._domainkey.example.com. Open an email you sent, view its full headers (in Gmail: More > Show original), and find DKIM-Signature: the value after s= is the selector.

Can a domain have two SPF records?

No. With more than one TXT record starting with v=spf1, receivers treat SPF as broken and it fails for all your mail. Merge them into one record with every include: and a single ending like ~all.

What happens when SPF has more than 10 DNS lookups?

Receivers stop at 10 and SPF fails with a permanent error, as if you had no SPF at all. Each include:, a, mx, ptr, exists and redirect counts, including the ones inside included records. Remove services you no longer use, or move bulk mail to a subdomain.

Is a 1024-bit DKIM key still OK?

Yes, receivers still accept 1024-bit keys. 2048-bit keys are stronger and Google recommends them, so switch when your provider lets you. Gmail treats mail signed with a key shorter than 1024 bits as unsigned.

Should my DMARC policy be none, quarantine or reject?

Start with p=none to collect reports without affecting delivery. Once the reports show your own services pass, move to p=quarantine (failing mail goes to spam), then p=reject (failing mail is refused). A domain that sends no email can go straight to p=reject.

Does a valid DKIM record mean my email passes DKIM?

Not on its own. The record only publishes the key; your provider must also sign outgoing mail with the matching private key. Check the headers of a message you sent: Authentication-Results should show dkim=pass for your domain.

Updated October 20, 2026 · Works in current Chrome, Edge, Firefox and Safari · Uses a QuickFixBase server check