Email domain check: SPF, DKIM, DMARC

>

If emails from your domain land in spam, the most common cause is missing or broken SPF, DKIM and DMARC records. Enter a domain to find out exactly what is not set up.

What the email check verifies

The check reads the DNS records that decide whether mail from a domain is delivered or lands in spam: MX (where incoming mail goes), SPF (which servers may send mail for the domain), DKIM (the public key that signs outgoing mail) and DMARC (what receivers should do with mail that fails these checks).

For SPF it also follows every include and redirect and counts the DNS lookups, because a record that needs more than 10 is invalid by the standard (PermError) and receivers ignore it. DKIM keys sit under a selector name chosen by your mail provider; the check tries the common ones: default, google, selector1, selector2, k1 and dkim.

How to read the email result

  • MX records: no MX means the domain cannot receive mail.
  • SPF: exactly one record, ending in ~all or -all, with fewer than 10 lookups. Two SPF records are an error.
  • DKIM: a key found under a common selector is good. Not found may simply mean your provider uses another selector, so check its panel before you add anything.
  • DMARC: p=none only monitors; p=quarantine or p=reject actually protects your domain from being spoofed.
  • Gmail and Yahoo require SPF or DKIM from every sender, and SPF, DKIM and DMARC from bulk senders.

Related errors and guides

Frequently asked questions

Everything is green, but my emails still go to spam. Why?
Authentication is necessary but not sufficient. Check the sending IP in blacklists, its reverse DNS (PTR), the content and links of the message, and whether recipients mark your mail as spam.
Do I need DMARC if I already have SPF and DKIM?
Yes if you send to Gmail or Yahoo in any volume, and it is the only record that tells receivers to reject mail forged in your name. Start with p=none, read the reports, then move to quarantine.
Can I check a domain I don't own?
Yes. All these records are public DNS. It is a common way to see which mail provider a company uses or to work out why mail to them bounces.