Free tool
SPF, DKIM and DMARC checker
Enter a domain to see whether its email is authenticated, what's wrong if it isn't, and the exact record to publish next.
Sending outreach from this domain? GEOboom finds the pages AI answers cite and runs the outreach to get you mentioned on them, with the mailboxes included.
See how it worksWhat the three records do
SPF
A TXT record on your domain listing the servers allowed to send as you. Every service that sends your mail needs to be in it: your mailbox provider, newsletter tool, CRM and helpdesk.
DKIM
A public key in DNS. Your mail server signs each message with the matching private key, and the receiver checks the signature. Each sending service usually has its own key under its own selector.
DMARC
The policy. A message passes DMARC when SPF or DKIM passes for your domain, and DMARC tells the receiver what to do when neither does: deliver it, send it to spam, or refuse it.
Questions
Do I need all three?
Yes, if the domain sends email. Since 2024 Gmail and Yahoo require SPF, DKIM and DMARC from anyone sending in bulk, and mail without them is far more likely to go to spam. DMARC is the one that protects the domain: SPF and DKIM only say whether a message passed, and DMARC tells the receiver what to do when it didn't.
Why does the checker say it couldn't find DKIM when I know it's set up?
DKIM keys live under a name called a selector, and DNS can't list them, so any checker can only try likely names. We try your mailbox provider's and about twenty common ones. Services like Amazon SES, Postmark and HubSpot use selectors nobody can guess. Open an email you sent, view its headers, find DKIM-Signature and copy the value after s=, then enter it above.
What is the 10-lookup limit in SPF?
Each include, a, mx, ptr and exists in an SPF record makes the receiver do a DNS lookup, and so does every include inside those includes. Past ten, receivers stop and treat the record as broken, which fails SPF for all your mail. The record looks fine when you read it, which is why we count the lookups the way a receiver does.
Should I go straight to p=reject?
No. Start at p=none with a rua address, read the reports for two to four weeks until only your own services show up as passing, then move to quarantine, and later to reject. Going straight to reject refuses mail from any service you forgot to list.
~all or -all?
With DMARC enforcing, ~all is enough, and it is what Google's own setup instructions use: DMARC decides what happens to failing mail. -all works too, but some receivers then reject a message on SPF alone, before DKIM has had a chance to pass it, which hurts forwarded mail.