Email DNS Checker (SPF, DMARC, DKIM)
About the Email DNS Checker
Check whether a domain’s email is set up correctly. The tool reads its MX, SPF, DMARC and DKIM records, grades the setup from A to F and explains each problem with a specific fix — the most common reasons legitimate email lands in spam or gets rejected.
To answer, this tool sends the domain or IP address you look up to public lookup services, so it needs an internet connection.
How to use it
- Enter your domain, or any email address at it.
- If you know your DKIM selector, enter it for an exact check.
- Work through any warnings or failures, starting with the red ones.
- Re-run the check after updating DNS (changes can take up to the record’s TTL to appear).
Frequently asked questions
What are SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature to each message so receivers can verify it wasn’t altered. DMARC tells receivers what to do when a message fails SPF and DKIM — nothing, send it to spam, or reject it — and where to send reports.
Do I need DMARC?
Yes. Since 2024, Gmail and Yahoo require a DMARC record for anyone sending bulk email, and having one improves deliverability for everyone. Start with p=none and a rua address to collect reports, then move to quarantine and reject.
What is the SPF 10-lookup limit?
SPF evaluation may trigger at most 10 DNS lookups (each include, a, mx, ptr, exists and redirect counts, including nested ones). Going over makes SPF fail for every message. Remove unused services or replace some includes with ip4:/ip6: ranges.
How do I find my DKIM selector?
Open the full headers of an email you sent and find the DKIM-Signature line — the s= value is the selector. Your email provider’s DKIM settings page shows it too. Google Workspace uses “google” and Microsoft 365 uses “selector1” and “selector2”.
Should SPF end in -all or ~all?
-all (hard fail) tells receivers to reject mail from unlisted servers; ~all (soft fail) marks it as suspicious. With DMARC enforcing, ~all is widely used and safe. Never use +all, which lets anyone send as your domain.