SPF, DKIM and DMARC checker

Three DNS records that prove email really comes from your domain. SPF lists the servers allowed to send it. DKIM publishes a public key that checks the signature your mail server adds to each message. DMARC tells receivers what to do when a message fails, and where to send reports about it.

Enter your domain in the SPF checker above. It reads the SPF record from DNS, checks the syntax, counts the DNS lookups against the limit of 10, follows every include, and lists the IP ranges it allows, with a fix for each problem it finds.

The DMARC checker reads the TXT record at _dmarc on your domain and shows the policy, the subdomain policy, the percentage, the alignment mode and where reports go. If there is no record, the DMARC generator tab builds one.

The DKIM checker looks for a key at 25 common selectors. For any other selector, type it in the selector box. It shows whether the key is published, its type and its length, and warns about keys shorter than 2048 bits.

Gmail requires every sender to set up SPF or DKIM, and senders of more than 5,000 messages a day to Gmail accounts to set up SPF, DKIM and DMARC. Outlook.com has applied the same rule to senders of more than 5,000 messages a day since May 2025. Publishing all three also stops other people sending convincing mail in your name, so it is worth doing at any volume.

The score adds up what is in place: a valid SPF record and a DKIM key are worth 25 points each, a DMARC policy up to 30 depending on how strict it is, DMARC reports 5, MTA-STS 10 and TLS reporting 5. A domain with SPF, DKIM and DMARC at p=reject scores 80 or more. The score is ours, not a standard, and is there to show what to fix next.

RFC 7208 caps the terms that make a receiver do a DNS lookup, which are include, a, mx, ptr, exists and redirect, at 10 for one SPF check. Includes count the lookups inside them too. Past 10 the receiver returns a permanent error and SPF fails for every message. The checker and the SPF generator both count them, including nested includes.

A DKIM key lives at a name made from a selector that your email provider chooses, and DNS has no way to list them. The checker tries 25 selectors the large providers use. If yours is different, open a message you sent, find the DKIM-Signature header, and type the value after s= into the selector box.

With DMARC in place, either works, because DMARC decides what happens to failing mail. -all asks receivers to reject unlisted servers outright, ~all marks them as suspicious. Many teams start with ~all while they confirm every sending service is listed, then move to -all.

Publish p=none with a rua address first and read the aggregate reports for two to four weeks. Add every legitimate sender you find to SPF and set up DKIM for each. When all your own mail passes, move to p=quarantine, then to p=reject. The DMARC generator tab builds each step.

MTA-STS tells other mail servers to deliver to you only over an encrypted connection with a valid certificate, which stops an attacker on the network from forcing plain-text delivery. It needs a TXT record at _mta-sts and a small policy file on https://mta-sts.yourdomain. TLS reporting, a TXT record at _smtp._tls, asks senders to email you a daily report when encrypted delivery fails.

BIMI shows your logo next to your messages in supporting inboxes such as Gmail, Apple Mail and Yahoo. It needs DMARC at p=quarantine or p=reject, a TXT record at default._bimi pointing to your logo as an SVG file, and for Gmail a mark certificate for the logo.