SPF, DKIM and DMARC checker
Check whether your domain can prove its own mail is yours.
Free and no signup. This one fetches the URL from our server; nothing about it is stored.
This one runs from our server rather than your browser, so the address does leave your machine. Nothing about it is stored.
About this tool
Since February 2024 Google and Yahoo require SPF, DKIM and DMARC from anyone sending bulk mail, so this stopped being an optional hardening step and became the difference between reaching an inbox and not. The failure is silent by design: your mail is accepted by your own provider and quietly binned by everyone else.
- The SPF ten-lookup limit is the one that bites. Exceed it and the record does not degrade — it returns permerror, and receivers treat that as having no SPF at all. It happens on the day somebody adds one more include.
- DKIM selectors cannot be enumerated. Eight common ones are checked, so a miss means "not one of these", never "no DKIM" — and the tool says exactly that rather than reporting a failure.
- Two SPF records is the same as none. A domain may publish exactly one; two make the check return permerror.
- p=none monitors and never blocks. It is the right place to start and the wrong place to stay — without moving to quarantine or reject, nothing is actually prevented.
Questions
- Do I need all three of SPF, DKIM and DMARC?
- Yes, if you send to Gmail or Yahoo in any volume. Since 2024 they require all three from bulk senders, and DMARC needs SPF or DKIM to align to do anything at all.
- What is the SPF ten-lookup limit?
- SPF allows ten DNS-lookup mechanisms — include, a, mx, ptr, exists, redirect. Past ten the record returns permerror and is treated as absent, which is why adding one more provider can break mail that worked yesterday.
- Why can you not find my DKIM record?
- DKIM lives under a selector you choose, and selectors cannot be listed from outside. Eight common ones are checked; if yours is custom, your provider will tell you its name.