SPF / DKIM / DMARC checker
Check a domain's email authentication records and spot deliverability gaps.
Have feedback or an idea for this tool?
What are SPF, DKIM and DMARC?
SPF, DKIM and DMARC are the three DNS records that prove your email is genuine and keep it out of spam folders. SPF lists the servers allowed to send mail for your domain, DKIM adds a cryptographic signature that shows a message was not altered in transit, and DMARC tells receivers what to do when a message fails those checks and where to send reports. This tool looks up all three for a domain, plus an optional DKIM selector, and flags what is missing or misconfigured. Enter a domain to check it. Gaps here are the usual reason legitimate mail lands in spam or is spoofed by others. Use it to fix deliverability before a campaign, to set up a new sending domain correctly, or to confirm DMARC is enforcing rather than only monitoring.
Key facts
- SPF (Sender Policy Framework) is a DNS TXT record at the domain root that begins with v=spf1, lists the servers authorised to send mail for the domain, and ends with an all mechanism.
- DKIM (DomainKeys Identified Mail) publishes a public key in DNS at selector._domainkey.yourdomain.com so the receiver can verify a cryptographic signature the sending server added to each message.
- DMARC is a TXT record at _dmarc.yourdomain.com that sets the policy (p=none, p=quarantine or p=reject) for mail failing SPF or DKIM and can send aggregate reports via a rua address.
- DMARC alignment requires the domain that passed SPF or DKIM to match the visible From header domain, and a message passes DMARC when at least one of SPF or DKIM both passes and aligns.
- SPF evaluation is capped at 10 DNS lookups counting every include, a, mx, ptr and exists mechanism, and exceeding the limit produces a permerror treated as a failure.
What SPF, DKIM and DMARC each do
SPF (Sender Policy Framework) is a TXT record at your domain root that lists which servers are allowed to send mail as you. It always begins with v=spf1 and ends with an all mechanism. Receivers check the sending IP against this list.
DKIM (DomainKeys Identified Mail) publishes a public key in DNS at selector._domainkey.yourdomain.com. Your outbound server signs each message with the matching private key, and the receiver verifies the signature to confirm the message was not altered in transit.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do when SPF or DKIM fails, and it can send you aggregate reports so you can see who is sending mail in your name.
How the three work together (and alignment)
SPF and DKIM each produce a pass or fail, but on their own they do not decide the fate of a message. DMARC is the layer that ties them together and enforces a policy.
DMARC also requires alignment: the domain that passed SPF or DKIM must match the domain in the visible From header. SPF alignment compares the From domain to the Return-Path (envelope sender) domain; DKIM alignment compares it to the d= tag in the signature. A message passes DMARC when at least one of SPF or DKIM both passes and aligns.
This is why forwarding often breaks SPF but DKIM survives, and why relying on DKIM alignment tends to be the more robust path to a passing DMARC result.
SPF limits and record hygiene
SPF evaluation is capped at 10 DNS lookups. Every include:, a, mx, ptr and exists mechanism counts, and nested includes count too. Exceed 10 and receivers return a permerror, which is treated as a fail. Many domains hit this by chaining several SaaS senders.
Keep one SPF record per domain - two v=spf1 TXT records is a permerror. Prefer include: for third-party senders over hard-coded ip4/ip6 blocks. Flatten only as a last resort, because flattening breaks when a provider changes its IPs.
Choose your all mechanism deliberately. ~all (softfail) tells receivers to accept but mark suspicious mail from unlisted servers; -all (hardfail) tells them to reject it. A sample record: v=spf1 include:_spf.google.com include:sendgrid.net ~all
The 2024 Gmail and Yahoo requirements
Since February 2024, Gmail and Yahoo require bulk senders (those sending roughly 5,000 or more messages a day to their users) to authenticate with SPF and DKIM, keep valid forward and reverse DNS on the sending IP, honour one-click List-Unsubscribe, and stay under a spam-complaint threshold. Critically, they also require a DMARC record - even a monitoring-only one.
In practice this makes DMARC effectively mandatory for any serious sending domain, not just bulk senders, because the same rules now gate deliverability across the largest mailbox providers.
A safe starting DMARC record collects data without touching delivery: v=DMARC1; p=none; rua=mailto:[email protected]. Once your reports confirm all legitimate mail aligns, tighten p to quarantine and then reject.
Glossary
- SPF (Sender Policy Framework)
- A DNS TXT record at the domain root that begins with v=spf1 and lists the servers authorised to send mail for the domain, ending with an all mechanism. Receivers check the sending IP against this list to see whether it is allowed to send as the domain.
- DKIM (DomainKeys Identified Mail)
- An authentication method that publishes a public key in DNS at selector._domainkey.yourdomain.com while the sending server signs each message with the matching private key. The receiver verifies the signature to confirm the message was not altered in transit.
- DMARC
- A TXT record at _dmarc.yourdomain.com that sets the policy (p=none, p=quarantine or p=reject) for mail failing SPF or DKIM and can request aggregate reports via a rua address. It is the enforcement and reporting layer that ties SPF and DKIM together.
- DMARC alignment
- The requirement that the domain which passed SPF or DKIM matches the visible From header domain. SPF alignment compares the From domain to the Return-Path domain and DKIM alignment compares it to the signature's d= tag; a message passes DMARC when at least one of SPF or DKIM both passes and aligns.
- DNS TXT record
- A DNS record type that holds free-form text and carries email-authentication policies including SPF, the DKIM public key and DMARC. SPF and DMARC each require exactly one such record, and duplicates produce a permerror.
- SPF 10-lookup limit
- A cap of 10 DNS lookups when a receiver evaluates an SPF record, counting every include, a, mx, ptr and exists mechanism including nested includes. Exceeding it produces a permerror that is treated as an SPF failure.
Questions, answered.
What is the difference between SPF, DKIM and DMARC?+
SPF authorises which servers may send for your domain, DKIM cryptographically signs each message so receivers can confirm it was not altered, and DMARC sets the policy for what happens when SPF or DKIM fails and gives you reporting. SPF and DKIM are the checks; DMARC is the enforcement and visibility layer on top.
What does ~all mean versus -all in an SPF record?+
Both are the final catch-all for servers not listed in your record. ~all is a softfail, meaning receivers should accept the mail but treat it as suspicious; -all is a hardfail, meaning they should reject it outright. Use ~all while you are still confirming every legitimate sender, then move to -all once you are confident the record is complete.
What is the SPF 10 DNS lookup limit?+
SPF allows at most 10 DNS lookups when a receiver evaluates your record. Each include, a, mx, ptr and exists mechanism counts, including nested includes inside other providers' records. Exceeding 10 produces a permerror, which is treated as an SPF failure, so keep your includes lean and remove senders you no longer use.
How do I find my DKIM selector?+
Send a message to an account you control, open the raw source, and look at the DKIM-Signature header. The s= tag is your selector and the d= tag is the signing domain. The public key then lives in DNS at selector._domainkey.d-domain. Your mail platform, such as Google Workspace or a marketing tool, also shows the selector when you set DKIM up.
What should my DMARC policy start at?+
Start at p=none with a rua address, for example v=DMARC1; p=none; rua=mailto:[email protected]. This monitors without affecting delivery and sends you aggregate reports. Once the reports confirm all your legitimate mail passes and aligns, move to p=quarantine and finally p=reject. Jumping straight to reject risks dropping real email.
Is DMARC now required for sending email?+
Effectively yes. Since February 2024, Gmail and Yahoo require bulk senders to publish a DMARC record along with valid SPF and DKIM. Because those two providers cover a large share of inboxes, most serious sending domains now need at least a p=none DMARC record to maintain deliverability, not only high-volume senders.
What is DMARC alignment and why does my mail fail it?+
Alignment requires the domain that passed SPF or DKIM to match the domain in the visible From header. SPF aligns against the Return-Path domain and DKIM aligns against the signature's d= domain. Mail often fails alignment when a third-party sender uses its own domain for the envelope or signature, so you must configure that provider to send or sign as your domain.
Why is my email still going to spam with all three records set?+
Authentication proves who you are, not that your content or IP is trusted. If SPF, DKIM and DMARC all pass but mail still lands in spam, check that the records actually align under DMARC, that your sending IP or domain is not on a blocklist, and that your content and sending reputation are healthy. Alignment and reputation are the usual culprits once the records themselves are correct.
Cloud that speaks India.
These tools run on ServerCake infrastructure in India. When our cloud opens, you get VMs and managed databases priced in ₹, billed with GST, on India-resident infrastructure. Reserve your spot for early access.
Reserve your spot