SPF, DKIM and DMARC checker: is your domain ready to send?

Three DNS records that prove your emails really come from you. SPF lists the servers allowed to send for your domain. DKIM signs each email with a key published in your DNS. DMARC tells inboxes what to do when a message fails both checks, and where to send reports.

Since February 2024, Gmail and Yahoo require every sender to authenticate with SPF or DKIM, and bulk senders (more than 5,000 emails a day to Gmail) to have SPF, DKIM and DMARC. Without them, your emails land in spam or get rejected, however good your list is.

A DKIM key lives under a name chosen by your sending tool, called a selector (google, selector1, k1…). The tool tries the most common ones; if yours is custom, type it in the DKIM selector field. You'll find it in your email provider's DKIM settings, or in the DKIM-Signature header of an email you sent (s=…).

An SPF record may trigger at most 10 DNS lookups (each include, a, mx…). Past that, inboxes treat it as invalid and SPF fails for every email. Remove the services you no longer use, or replace their include with their IP ranges.

Start with p=none and a rua address to receive reports, without any risk for your emails. Once the reports show that all your legitimate senders pass, move to p=quarantine, then p=reject.

Nothing is stored and nothing goes through Enrow: your browser queries Cloudflare's public DNS directly, and the results are gone when you close the page. The tool is free and unlimited, with no sign-up.