SPF, DKIM and DMARC Checker

Check whether a domain is set up to send email that gets delivered. Enter a domain or an email address: the checker reads its SPF, DKIM and DMARC records and explains each result.

Free and unlimited. Lookups run in your browser, nothing is sent to mailcheck.

SPF: who may send for your domain

SPF is a TXT record on your domain, starting with v=spf1, that lists the servers allowed to send your email. The checker reads it and applies the rules of RFC 7208:

  • One record only. Two SPF records on the same domain produce a permanent error. Merge them into one.
  • At most 10 DNS lookups. The include, a, mx, ptr and exists mechanisms and the redirect modifier each count, nested includes too. Beyond 10, SPF fails.
  • The ending matters. -all fails unlisted servers, ~all soft-fails them, ?all stays neutral, and +all lets any server in the world send as you.
  • No ptr. The RFC says the ptr mechanism should not be published.

DKIM: proof the message is yours

DKIM signs each message with a private key. Receivers check the signature with the public key published in DNS at selector._domainkey.yourdomain.com. The selector is chosen by your provider: google by default on Google Workspace, selector1 and selector2 on Microsoft 365, where only one of the two is active at a time. A record with an empty p= value means the key was revoked.

DMARC: what happens when checks fail

DMARC is a TXT record at _dmarc.yourdomain.com, starting with v=DMARC1. Its p tag sets the policy for messages that fail: none (monitor only), quarantine (treat as suspicious, usually spam) or reject. The rua tag sets where aggregate reports go, and pct applies the policy to a share of your mail. If a domain publishes more than one DMARC record, receivers apply no policy at all.

Gmail sender requirements

Google requires every sender to Gmail accounts to set up SPF or DKIM. Senders of more than 5,000 messages a day to Gmail accounts must set up SPF, DKIM and DMARC (a policy of none is accepted), align the From: domain with the SPF or DKIM domain, offer one-click unsubscribe on marketing messages, and keep the spam rate in Postmaster Tools below 0.30%. Alignment depends on how each message is sent, so a DNS check cannot confirm it: send yourself a message and look for dmarc=pass in its headers.

Frequently asked questions

What do SPF, DKIM and DMARC do?

SPF lists the servers allowed to send email for your domain. DKIM adds a signature that proves the message was not altered and comes from your domain. DMARC tells receiving servers what to do when a message fails those checks, and where to send reports.

Why can the checker not find my DKIM record?

DKIM records live under a name chosen by your email provider, the selector, and DNS offers no way to list them. The checker tries the defaults of Google Workspace (google) and Microsoft 365 (selector1, selector2). For any other provider, enter the selector shown in its settings, or read it in the s= value of the DKIM-Signature header of an email you sent.

Is p=none enough for DMARC?

For Gmail bulk sender requirements, yes: Google accepts a DMARC policy set to none. It only monitors, though. Failing messages are not blocked until you move to quarantine or reject.

What is the SPF 10 lookup limit?

RFC 7208 caps the terms that trigger DNS queries (include, a, mx, ptr, exists and redirect) at 10 per evaluation, counting nested includes. Beyond that, receivers return a permanent error and SPF fails.

Does this tool store the domains I check?

No. The lookups run in your browser through Cloudflare public DNS resolver. The domain you enter is never sent to mailcheck.

Sources

Authentication set, now know who reads. mailcheck shows when each email you send is opened and which link is clicked, in Gmail, Outlook, Zoho Mail and more. See how it works.