How to use the SPF, DKIM & DMARC Checker
- Enter the domain you send email from (the part after @).
- Click Check email setup. The checker reads the domain’s DNS records over DNS-over-HTTPS.
- Work through the results from top to bottom — each problem comes with a suggested fix.
- After changing DNS, wait for the TTL to expire and check again.
Why SPF, DKIM and DMARC matter
Since February 2024, Gmail and Yahoo require bulk senders to authenticate their mail with SPF and DKIM and to publish a DMARC policy; Microsoft introduced similar requirements for Outlook in 2025. Even small senders benefit: authenticated mail lands in the inbox more reliably, and DMARC stops others from spoofing your domain in phishing emails.
| Record | Where | What it does |
|---|---|---|
| SPF | TXT on the domain: v=spf1 … ~all | Lists servers allowed to send mail for the domain |
| DKIM | TXT at selector._domainkey | Public key that verifies the cryptographic signature on each message |
| DMARC | TXT at _dmarc: v=DMARC1; p=… | Tells receivers what to do if SPF/DKIM fail and where to send reports |
| MTA-STS / TLS-RPT | _mta-sts / _smtp._tls | Enforces and reports encrypted delivery to your domain |
| BIMI | default._bimi | Shows your logo in supporting inboxes (needs DMARC enforcement) |
The most common mistakes
- Two SPF records — adding a new tool often adds a second
v=spf1record. Only one is allowed; merge them. - More than 10 DNS lookups — every
include:counts, including nested ones. Over 10 causes a permanent SPF error. Remove unused services or flatten the record. - DMARC stuck at p=none — monitoring is a start, but only
quarantineorrejectactually protects your domain. - Forgetting third-party senders — newsletters, CRMs (HubSpot, Mailchimp), helpdesks and website forms must be covered by SPF and DKIM too.
DKIM selectors
DKIM keys live under a selector chosen by the sending service (for example google, selector1/selector2 for Microsoft 365, k1 for Mailchimp). Selectors can’t be listed via DNS, so the checker tries 30 common ones. If yours isn’t found, open a received email’s headers and look for DKIM-Signature: … s=selector, then check that record with DNS Lookup. For ports on your mail server, use the Port Checker.
Tools that pair well with the SPF, DKIM & DMARC Checker
- WHOIS Lookup — Enter a domain to see its registrar, creation and expiry dates, domain age, status codes, nameservers and DNSSEC — or an IP address to find the network and organisation that owns it.
- DNS Propagation Checker — Changed DNS or moved a site to Webflow?
- SSL Checker — Verify an HTTPS certificate in seconds — see when it expires, who issued it, which hostnames it covers and whether the chain is trusted.
- Ping Test — Measure how fast a server responds: enter a host and get the round-trip latency, jitter and failed attempts over several pings — measured from our server with a TCP ping to the port you choose.
Frequently asked questions
What is a good DMARC policy?
Start with p=none and a rua reporting address to see who sends mail as your domain. Once all legitimate senders pass SPF or DKIM, move to p=quarantine and finally p=reject.
Why does my SPF fail with too many lookups?
SPF allows at most 10 DNS lookups. Each include:, a, mx, ptr, exists and redirect counts — including those inside included records. Remove services you no longer use or use an SPF flattening service.
Why can’t the checker find my DKIM key?
DKIM records use a selector chosen by your email service, and DNS can’t list them. We test 30 common selectors; if yours is custom, look up the selector in an email header (s=…) and query
selector._domainkey.yourdomain.Do I need SPF, DKIM and DMARC for Google Workspace?
Yes. Add Google’s SPF include (_spf.google.com), turn on DKIM in the Admin console (Apps → Gmail → Authenticate email) and publish a DMARC record.