What this checks
- SPF
- The list of servers allowed to send email as your domain. We count its DNS lookups (the limit is 10, and going over breaks SPF for every message), follow every include, and catch duplicate records.
- DKIM
- A digital signature on each email. We look for keys under 35 common selectors, or the one you enter, and flag weak 1024-bit keys.
- DMARC
- Your instruction to receivers about emails that fail SPF and DKIM: deliver (none), send to spam (quarantine) or block (reject).
- MX and blacklists
- Whether your domain can receive replies, and whether your mail servers or domain are on public spam blacklists.
The usual reasons email lands in spam
- No DMARC record. Gmail, Yahoo and Microsoft all require one from bulk senders.
- A new tool was added without updating SPF, or so many were added that SPF went over 10 lookups.
- DKIM was never switched on in the email provider or the newsletter tool.
- Two SPF records. When a second tool's setup guide says "add this TXT record", people often add a new one instead of merging. Two records means neither works.
- Content and reputation. Even with perfect DNS, sending to old lists or getting spam complaints above 0.3% hurts delivery.
Free generators
Building records from scratch? Use the SPF record generator and the DMARC record generator.
Frequently asked questions
Is this checker free?
Yes, unlimited checks of one domain at a time with no account. Pro adds bulk checks, daily monitoring and branded reports for agencies.
Do you store the domains I check?
No. The lookups go straight from your browser to public DNS services (Cloudflare, with Google as a backup). We only see an anonymous count that a check happened.
Why can't you find my DKIM key?
DKIM keys live under a "selector" name that each provider chooses. We try 35 common ones. Open a sent email, view the original headers, find DKIM-Signature and copy the value after s= into the selector box.
Is ~all or -all better for SPF?
With DMARC in place, ~all (soft fail) is the common choice: DMARC decides what happens to failing mail. Use -all only when you are sure every service that sends for you is listed.
Some blacklists show "no answer". Why?
Some lists, including Spamhaus, refuse lookups from public DNS services. Use the link in the report to check them directly.