SPF, DKIM and DMARC checker

What SPF, DKIM and DMARC do

They're three DNS records on the domain you send from, and together they prove an email really came from you.

• SPF lists the servers allowed to send as your domain: your email platform, Google Workspace or Microsoft 365, your help desk.
• DKIM adds a signature to each email that receivers check against a public key in your DNS, so they know it wasn't changed on the way.
• DMARC tells receivers what to do when an email fails both (nothing, spam folder or reject) and sends you reports on who's sending as you.

Since February 2024, Gmail and Yahoo require SPF, DKIM and a DMARC record from anyone sending more than 5,000 emails a day to their users, and Microsoft followed for Outlook.com in 2025. Without them, marketing email goes to spam or is refused.

How to fix what it finds

• No SPF, or two SPF records: keep one TXT record starting v=spf1, list every service that sends for you with include:, and end with ~all.
• Over 10 lookups: remove services you no longer use. If you need them all, your DNS provider or email platform can "flatten" the record.
• No DKIM: every email platform has a domain authentication page that gives you the records to add (often two or three CNAMEs). Add them, then verify in the platform.
• No DMARC: start with p=none and a reporting address, watch the reports for a few weeks, then move to p=quarantine and finally p=reject.

How the checker works

It looks up your domain's public DNS records from your browser, through Cloudflare's public DNS service. It can't see your email platform's settings, so two things on the Gmail and Yahoo list (alignment and one-click unsubscribe) are shown as things to check there. DKIM keys live under a "selector" each platform chooses; the checker tries the common ones, and you can add your own.

Frequently asked questions

Is this SPF, DKIM and DMARC checker free?

Yes, with no sign-up. It looks up public DNS records from your browser, so nothing about your domain is stored.

Why can't it find my DKIM record?

DKIM keys sit under a selector that your email platform chooses (for example k1 for Mailchimp or s1 for SendGrid). The checker tries the common ones; if yours is different, find the selector in your platform's domain authentication settings and enter it.

What DMARC policy should I use?

Start with p=none and a rua= reporting address. When the reports show all your real email passing, move to p=quarantine, then p=reject. That order avoids blocking your own mail.

What are the Gmail and Yahoo sender requirements?

Since February 2024, senders of more than 5,000 emails a day to Gmail or Yahoo need SPF and DKIM, a DMARC record (at least p=none), a From address aligned with SPF or DKIM, one-click unsubscribe in marketing email, and a spam complaint rate under 0.3%.

What is the SPF 10 lookup limit?

An SPF check may make at most 10 DNS lookups, counting every include, a, mx, exists and redirect, including those inside other includes. Over 10, SPF fails for every email.

Do I need BIMI?

No, it's optional. It shows your logo next to your emails in supporting inboxes, and needs DMARC at quarantine or reject first.