Free tool
SPF, DKIM and DMARC checker
Enter a domain to check SPF, DKIM, DMARC and MX in one go, with a pass, warning or fail for each record.
Try
Lookups go from your browser to Cloudflare's public DNS resolver; nothing is stored. Without a selector the checker tries the ones providers document.
What you get
The result, in plain words
- Pass, warning or fail for SPF, DKIM, DMARC and MX
- SPF lookups counted against the limit of 10
- DKIM keys found at google, selector1, selector2 and 50+ other selectors
- The records to publish, with the steps at your DNS host
About this tool
About the SPF, DKIM and DMARC checker
A domain passes when it has one SPF record within 10 DNS lookups, a DKIM key on its own domain, a DMARC record with a policy and MX records. Each finding says what breaks, and the records to publish come laid out for your DNS host.
The lookups run in your browser through Cloudflare's public DNS-over-HTTPS resolver. Nothing is sent to our servers or stored.
How it works
How to read the result
Every finding has a level, and each record shows its worst one. Error: the check fails or the record is missing; fix it before you send. Warning: fix it soon or confirm it by hand. Note: read it and decide.
SPF4
No SPF record error:
Receivers get SPF none; publish one TXT record that starts with v=spf1 and includes the provider you send from
Two or more SPF records, or more than 10 DNS lookups errors:
SPF returns permerror for every message; merge the records and cut lookups as in fixing SPF permerror
8 or 9 of 10 lookups, or a nested include with no SPF record warnings:
The next include can break SPF, and an include with no record already returns permerror; remove includes you no longer use
+all error, ?all, a missing all or ptr warnings:
End the record with ~all or -all and delete ptr, which RFC 7208 says should not be published
DKIM2
No DKIM key at the selectors tried warning:
Copy s= from the DKIM-Signature header of an email you sent into the selector field and check again
Empty p= or a 1024-bit key warnings:
An empty p= means the key is revoked; 1024 bits passes, and 2048 is the current recommendation
DMARC3
No DMARC record, more than one, no p= or an unknown policy errors:
Keep one TXT record at _dmarc.<domain>, such as v=DMARC1; p=none; rua=mailto:[email protected]
p=none warning:
Receivers send reports and take no DMARC action; it meets the Gmail and Yahoo requirement, and you raise it to quarantine once the aggregate reports show every sender passes
DMARC notes:
Without rua= you get no aggregate reports; adkim=s or aspf=s needs an exact domain match, and relaxed alignment is the usual choice for cold email
MX1
No MX record warning:
Publish the mailbox provider's MX records so replies and bounces reach its mail server
Beyond the records4
Every record OK and mail still fails:
Read the Authentication-Results header of an email you sent; the fixes for DKIM signature failures and DMARC alignment failures are in the test guide
For Google Admin console values, follow Google Workspace SPF, DKIM and DMARC setup
One record in depth:
The SPF checker expands every include as a tree and writes the fixed record, the DMARC checker explains each tag and the next policy step, the DKIM checker reads key length and the provider behind each selector, and the MX lookup shows the mail provider and the address of every host
Cold email domains:
What Gmail, Yahoo and Outlook require is in SPF, DKIM and DMARC for cold email; the email DNS audit skill runs these checks on a list of domains in Claude or ChatGPT
Background
Check SPF and DKIM on an email you sent
The DNS check above shows what the domain publishes. To see what a receiver decided for one message, send an email from the mailbox to a Gmail address you can open, then read its headers.
In Gmail on a computer, open the email, click More next to Reply, then Show original. The page lists SPF, DKIM and DMARC with PASS or FAIL above the full header; Copy to clipboard copies the header. Paste it into the email header analyzer to see each result, the signing d= domain and selector, and whether the domains align with the From address.
- SPF pass and DKIM pass with your own domain: the setup works for that sending path
- DKIM pass with d= set to your sending tool's domain: the tool signs for you; publish its custom DKIM record so DMARC can align
- Any fail while every record above is OK: the email went out through a server the SPF record does not list, or the message changed in transit after signing
Background
What each record does
- SPF lists the servers allowed to send as your domain: one TXT record per domain, starting with v=spf1; more than 10 DNS lookups makes it fail
- DKIM signs every email with a key published at <selector>._domainkey.<domain>; the selector comes from your provider, find it as s= in the DKIM-Signature header of an email you sent
- DMARC tells receivers what to do when SPF and DKIM fail to match the From domain: none (report only), quarantine or reject; Gmail and Yahoo require it for bulk senders
- MX records let the domain receive replies and bounces
Background
What cold email domains need
All four. Gmail and Yahoo reject or filter mail from bulk senders without SPF, DKIM and DMARC, and a cold email domain with no MX looks like it was set up to send and never read replies.
p=none is enough to meet the requirement. Move to quarantine once the reports show every service you send from passes.
Records are one part of a domain's reputation. The domain reputation check adds blocklists and domain age to the same records, and the email blacklist check looks a domain or a sending IP up on 13 blocklists.
Background
Records for your provider and DNS host
Each service that sends as your domain has its own SPF include and DKIM records, and each pre-set check below looks for exactly those. The setup pages by provider list them all.
- Sending providers: Microsoft 365, Salesforce, Mailchimp, SendGrid, Amazon SES, Mailgun, HubSpot and Zoho Mail
- DNS hosts, field by field: GoDaddy, Cloudflare, Namecheap and Squarespace
Free guide19 min read
Send 100,000 cold emails a month
Domains and mailboxes you need, DNS, warmup, lists, copy and follow-ups, with a launch checklist, sent to your inbox.
Questions
How do I find my DKIM selector?
Open an email you sent from the domain, view the original message and find the DKIM-Signature header. The value after s= is the selector. Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2.
What does too many DNS lookups mean for SPF?
SPF allows 10 DNS lookups in total, counting every include, a, mx, ptr, exists and redirect, including those inside the records you include. Above 10 the whole record fails. Remove services you no longer use.
Is p=none a valid DMARC policy?
Yes. It meets the Gmail and Yahoo requirement and sends you reports without affecting delivery. It does not protect the domain from spoofing; quarantine or reject does.
How is this different from the separate SPF, DKIM and DMARC checkers?
It runs the same rules on all four records at once and gives one verdict, the cold email checks and the records to publish. Each record card links to its own checker, which shows the full SPF include tree, every DMARC tag or every DKIM selector tried.
How do I fix SPF, DKIM and DMARC for a cold email domain?
Publish one SPF record with your mailbox provider's include, turn on DKIM in the provider (google for Google Workspace, selector1 and selector2 for Microsoft 365) and publish its key, then add v=DMARC1; p=none with a rua address. The result writes the SPF and DMARC records for your domain and the steps for Cloudflare, GoDaddy, Namecheap and Route 53.
How do I test SPF and DKIM?
Two steps. Enter the domain above to check the published SPF, DKIM and DMARC records. Then send a test email to a Gmail address, open Show original and read the SPF and DKIM results, or paste the header into the email header analyzer. The first test shows the records are right; the second shows a receiver accepted them for a real message.
Is this a DKIM validator?
For the published key, yes: it finds the DKIM record at the selector, checks that the key is present and not revoked, and reads its length. Whether a signature on one message verifies is decided by the receiver; the Authentication-Results header of an email you sent shows that result.
Does this tool store the domains I check?
No. The page queries Cloudflare's public DNS resolver from your browser. We receive nothing unless you ask us to email you the fixes.
In your AI assistant
Run the same checks in Claude or ChatGPT
Free SKILL.md files with the rules behind this tool. Install them in Claude or Claude Code, or paste them into ChatGPT, Gemini, Grok or Cursor.
Mailboxes, warmup and sending in one place
$2.50 a mailbox a month. DNS records are set for you, and every mailbox shows its warmup numbers from day one.
Deliverability call
Talk to our deliverability team
Book a call with the people who run our mailbox infrastructure. We look at your current setup and tell you what to change.
- Review your domains, DNS records and current inbox placement
- Size the setup: domains, mailboxes per domain and daily volume per mailbox
- Plan warmup and the move from your current provider or sequencer
Free call
See open times in your time zone and book on this page.
Or open the booking pageLoading available times…
Open the booking page instead