Email Security Checker: SPF, DKIM and DMARC

How to Read Your Results

Each check shows Pass, Needs work or Missing, plus the record we found.

• Missing means we found no record at all. Fix these first.
• Needs work means the record exists but is weak or has a mistake.
• Pass means the record is there and looks right.

Why These Records Matter

Big mail providers check these records on every message. Since 2024, Google and Yahoo have required SPF, DKIM and DMARC from bulk senders. Mail from a domain without them is more likely to land in spam or be turned away.

They also protect your name. Without DMARC, anyone can send email that claims to come from your domain.

What This Tool Cannot See

• DKIM needs a selector. A selector is a short name your mail provider picks. We try the common ones. If yours is different, type it in the selector box. Your provider's setup page will list it.
• We count SPF lookups at the top level only. Each include can hold more lookups, so the true count can be higher.
• We read DNS, not your mail. A message can still land in spam for other reasons, like its content or a sending server with a bad name.

Common Questions

What is a DKIM selector?

It is a short label that points to your public DKIM key in DNS. Google Workspace often uses google. Microsoft 365 uses selector1 and selector2. Your mail provider's setup page lists yours.

Can I have two SPF records?

No. A domain should have exactly one TXT record that starts with v=spf1. With two, receivers treat SPF as broken. Merge them into one record.

Which DMARC policy should I use?

Start with p=none and a report address, so you can see who sends as you. Once your real mail passes, move to p=quarantine and then p=reject.

Is this checker free?

Yes. It runs in your browser and reads public DNS records. There is no sign up and we do not store the domains you check.