MX, SPF, DKIM and DMARC checker
Enter a domain to see whether it can receive email and whether it is set up to prove its emails are genuine. Gmail, Yahoo and Outlook.com require these records from bulk senders.
What each record does
| Record | What it does | Where it lives |
|---|---|---|
| MX | Tells the world which server receives your email | Your domain |
| SPF | Lists the servers allowed to send email for your domain | A TXT record starting v=spf1 |
| DKIM | A digital signature that proves an email was not changed and came from you | A TXT record at selector._domainkey.yourdomain |
| DMARC | Tells receivers what to do with mail that fails SPF and DKIM, and where to send reports | A TXT record at _dmarc.yourdomain |
What the big mailbox providers require
Since February 2024, Gmail (for senders of more than 5,000 messages a day) and Yahoo (for bulk senders) require SPF, DKIM and a DMARC record of at least p=none, with the From domain aligned. Microsoft added similar rules for Outlook.com, Hotmail and Live in May 2025. Smaller senders benefit too: these records are one of the main things that keep real mail out of spam.
Common problems this tool finds
- Two SPF records. Only one is allowed; with two, SPF fails. Merge them.
+allin SPF. This lets anyone send as you. Use~allor-all.- Too many SPF lookups. SPF allows 10 DNS lookups in total. Each
include:counts, plus any lookups inside it. - No DMARC record. Add
v=DMARC1; p=none; rua=mailto:you@yourdomainto start monitoring. - DKIM not found. Turn on DKIM signing in your email provider and publish the key it gives you.
About DKIM selectors
DKIM keys are stored under a "selector" name chosen by your email provider, and there is no way to list them all. This tool tries common ones automatically: google (Google Workspace), selector1 and selector2 (Microsoft 365), k1, k2 and others. If yours is different, find it in your provider's DKIM settings, or in the s= part of the DKIM-Signature header of an email you sent, and enter it above.
Questions people ask
- What is a good DMARC policy?
- Start with p=none to collect reports without affecting delivery. Once all your real mail passes SPF or DKIM, move to p=quarantine and then p=reject for the strongest protection.
- Why does my domain fail SPF even though I have a record?
- The most common causes are two separate SPF records, more than 10 DNS lookups, or a sending service that is not listed in the record.
- Does this tool change my DNS?
- No. It only reads public DNS records. Changes are made where your domain's DNS is hosted, such as Cloudflare, Spaceship, GoDaddy or Namecheap.