Free tool
SPF, DKIM and DMARC checker
Enter a domain to check its SPF record (one record, at most 10 DNS lookups, ending in ~all or -all), its DMARC policy, its DKIM keys and its MX records. Each finding says what breaks and how to fix it.
The lookups run in your browser through Cloudflare's public DNS-over-HTTPS resolver. Nothing is sent to our servers or stored.
Lookups go from your browser to Cloudflare's public DNS resolver. Without a selector, the checker tries the common ones.
How it works
What each record does
- SPF lists the servers allowed to send as your domain. One TXT record per domain, starting with v=spf1. More than 10 DNS lookups makes it fail.
- DKIM signs every email with a key published at <selector>._domainkey.<domain>. The selector comes from your provider; find it as s= in the DKIM-Signature header of an email you sent.
- DMARC tells receivers what to do when SPF and DKIM fail to match the From domain: none (report only), quarantine or reject. Gmail and Yahoo require it for bulk senders.
- MX records let the domain receive replies and bounces.
Background
What cold email domains need
All four. Gmail and Yahoo reject or filter mail from bulk senders without SPF, DKIM and DMARC, and a cold email domain with no MX looks like it was set up to send and never read replies.
p=none is enough to meet the requirement. Move to quarantine once the reports show every service you send from passes.
FAQ
Questions
How do I find my DKIM selector?
Open an email you sent from the domain, view the original message and find the DKIM-Signature header. The value after s= is the selector. Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2.
What does too many DNS lookups mean for SPF?
SPF allows 10 DNS lookups in total, counting every include, a, mx, ptr, exists and redirect, including those inside the records you include. Above 10 the whole record fails. Remove services you no longer use.
Is p=none a valid DMARC policy?
Yes. It meets the Gmail and Yahoo requirement and sends you reports without affecting delivery. It does not protect the domain from spoofing; quarantine or reject does.
Does this tool store the domains I check?
No. The page queries Cloudflare's public DNS resolver from your browser. We do not receive the domain or the results.
In your AI assistant
Run the same checks in Claude or ChatGPT
Free SKILL.md files with the rules behind this tool. Install them in Claude or Claude Code, or paste them into ChatGPT, Gemini, Grok or Cursor.
Mailboxes, warm-up and sending in one place
$2.50 a mailbox a month. DNS records are set for you, and every mailbox shows its warm-up numbers from day one.