Free tool

SPF, DKIM and DMARC checker

Enter a domain to check its SPF record (one record, at most 10 DNS lookups, ending in ~all or -all), its DMARC policy, its DKIM keys and its MX records.

Lookups go from your browser to Cloudflare's public DNS resolver. If no selector is given, the checker tries the common ones.

About this tool

About the SPF, DKIM and DMARC checker

Each finding says what breaks and how to fix it.

The lookups run in your browser through Cloudflare's public DNS-over-HTTPS resolver. Nothing is sent to our servers or stored.

How it works

How to read the result

Every finding has a level, and each record shows its worst one. Error: the check fails or the record is missing; fix it before you send. Warning: fix it soon or confirm it by hand. Note: read it and decide.

  • No SPF record (error): receivers get SPF none; publish one TXT record that starts with v=spf1 and includes the provider you send from
  • Two or more SPF records, or more than 10 DNS lookups (errors): SPF returns permerror for every message; merge the records and cut lookups as in fixing SPF permerror
  • 8 or 9 of 10 lookups, or a nested include with no SPF record (warnings): the next include can break SPF, and an include with no record already returns permerror; remove includes you no longer use
  • +all (error), ?all, a missing all or ptr (warnings): end the record with ~all or -all and delete ptr, which RFC 7208 says should not be published
  • No DMARC record, more than one, no p= or an unknown policy (errors): keep one TXT record at _dmarc.<domain>, such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
  • p=none (warning): receivers send reports and take no DMARC action; it meets the Gmail and Yahoo requirement, and you raise it to quarantine once the aggregate reports show every sender passes
  • DMARC notes: without rua= you get no aggregate reports; adkim=s or aspf=s needs an exact domain match, and relaxed alignment is the usual choice for cold email
  • No DKIM key at the selectors tried (warning): copy s= from the DKIM-Signature header of an email you sent into the selector field and check again
  • Empty p= or a 1024-bit key (warnings): an empty p= means the key is revoked; 1024 bits passes, and 2048 is the current recommendation
  • No MX record (warning): publish the mailbox provider's MX records so replies and bounces reach its mail server
  • Every record OK and mail still fails: read the Authentication-Results header of an email you sent; the fixes for DKIM signature failures and DMARC alignment failures are in the test guide
  • For Google Admin console values, follow Google Workspace SPF, DKIM and DMARC setup
  • One record in depth: the SPF checker expands every include as a tree and writes the fixed record, the DMARC checker explains each tag and the next policy step, the DKIM checker reads key length and the provider behind each selector, and the MX lookup shows the mail provider and the address of every host
  • Cold email domains: what Gmail, Yahoo and Outlook require is in SPF, DKIM and DMARC for cold email; the email DNS audit skill runs these checks on a list of domains in Claude or ChatGPT

Background

What each record does

  • SPF lists the servers allowed to send as your domain: one TXT record per domain, starting with v=spf1; more than 10 DNS lookups makes it fail
  • DKIM signs every email with a key published at <selector>._domainkey.<domain>; the selector comes from your provider, find it as s= in the DKIM-Signature header of an email you sent
  • DMARC tells receivers what to do when SPF and DKIM fail to match the From domain: none (report only), quarantine or reject; Gmail and Yahoo require it for bulk senders
  • MX records let the domain receive replies and bounces

Background

What cold email domains need

All four. Gmail and Yahoo reject or filter mail from bulk senders without SPF, DKIM and DMARC, and a cold email domain with no MX looks like it was set up to send and never read replies.

p=none is enough to meet the requirement. Move to quarantine once the reports show every service you send from passes.

Records are one part of a domain's reputation. The domain reputation check adds blocklists and domain age to the same records, and the email blacklist check looks a domain or a sending IP up on 13 blocklists.

Background

Records for your provider and DNS host

Each service that sends as your domain has its own SPF include and DKIM records, and each pre-set check below looks for exactly those. The setup pages by provider list them all.

Free guide19 min read

Send 100,000 cold emails a month

Domains and mailboxes you need, DNS, warmup, lists, copy and follow-ups, with a launch checklist, sent to your inbox.

Unsubscribe in one click.

Questions

How do I find my DKIM selector?

Open an email you sent from the domain, view the original message and find the DKIM-Signature header. The value after s= is the selector. Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2.

What does too many DNS lookups mean for SPF?

SPF allows 10 DNS lookups in total, counting every include, a, mx, ptr, exists and redirect, including those inside the records you include. Above 10 the whole record fails. Remove services you no longer use.

Is p=none a valid DMARC policy?

Yes. It meets the Gmail and Yahoo requirement and sends you reports without affecting delivery. It does not protect the domain from spoofing; quarantine or reject does.

Does this tool store the domains I check?

No. The page queries Cloudflare's public DNS resolver from your browser. We do not receive the domain or the results.

In your AI assistant

Run the same checks in Claude or ChatGPT

Free SKILL.md files with the rules behind this tool. Install them in Claude or Claude Code, or paste them into ChatGPT, Gemini, Grok or Cursor.

Mailboxes, warmup and sending in one place

$2.50 a mailbox a month. DNS records are set for you, and every mailbox shows its warmup numbers from day one.

Create mailboxesBook a call

Deliverability call

Talk to our deliverability team

Book a call with the people who run our mailbox infrastructure. We look at your current setup and tell you what to change.

  • Review your domains, DNS records and current inbox placement
  • Size the setup: domains, mailboxes per domain and daily volume per mailbox
  • Plan warmup and the move from your current provider or sequencer

Free call

See open times in your time zone and book on this page.

Or open the booking page