FreeNo sign-up, results in seconds

Check SPF, DKIM and DMARC for any domain.

See whether a domain is protected against fake email and meets the Gmail, Yahoo and Microsoft sender rules, with what to fix in plain English.

No sign-upEvery include followedWhat to fix, explained
Try: Only the domain name is looked up
How to check a domain

Type it, check it, fix it.

1

Enter the domain

Type a domain such as example.com, or paste an email address. Add your DKIM selector if you know it.

2

Read the results

MX, SPF, DKIM and DMARC are each checked and explained, with every SPF include followed and counted.

3

Fix what is flagged

Each problem says what to change. Update the record at your DNS host, then check again.

How to fix it

Set up the three records.

Add an SPF record

  1. Sign in where your domain's DNS is managed (your registrar or Cloudflare).
  2. Add a TXT record on the domain itself (host @).
  3. Value: v=spf1 include:_spf.google.com ~all for Google Workspace, or include:spf.protection.outlook.com for Microsoft 365.
  4. Keep one SPF record: add other senders as more includes in the same record.

Add a DMARC record

  1. Add a TXT record with the host _dmarc.
  2. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
  3. Read the reports for a few weeks to find every service that sends as you.
  4. Then move to p=quarantine, and finally p=reject.

Turn on DKIM

  1. Google Workspace: Admin console › Apps › Google Workspace › Gmail › Authenticate email.
  2. Microsoft 365: Defender portal › Email authentication settings › DKIM.
  3. Add the TXT or CNAME records it shows at your DNS host, then start signing.
  4. Check here with the selector it gave you (google, selector1).
Why it matters

Three DNS records decide whether your email is trusted.

Anyone can send an email with your domain in the From line. SPF, DKIM and DMARC are how receivers tell your real email from fakes. SPF is a list of the servers allowed to send for the domain. DKIM is a key that lets receivers check the signature your email service adds to each message. DMARC links the two to the From address and tells receivers what to do with email that fails: deliver it, send it to spam, or refuse it.

Since 2024 Gmail and Yahoo require them: every sender needs SPF or DKIM, and anyone sending more than 5,000 emails a day to their users needs SPF, DKIM and a DMARC record. Microsoft applies the same rules to Outlook.com since 2025. Without them, newsletters, invoices and even ordinary replies land in spam or bounce.

The most common problem is SPF breaking quietly: every service you add (a newsletter tool, a helpdesk, a CRM) adds an include, and above 10 DNS lookups receivers stop reading the record. This checker follows every include and counts them. To see why one particular email failed, paste its headers into the email header analyzer.

Private by design

Only the domain name is looked up.

The checks run in your browser. It asks Cloudflare's public DNS (1.1.1.1) for the domain's public records over an encrypted connection, the same lookups every mail server makes. Nothing is sent to our servers, and we never see which domains you check.

MX records and the mail provider
SPF syntax, includes and the 10-lookup limit
DMARC policy, reports and subdomains
DKIM keys and their strength
MTA-STS, TLS reporting and BIMI
Gmail, Yahoo and Microsoft sender rules
Whether one email passed (use the header analyzer)
Blocklists and IP reputation
FAQ

SPF, DKIM and DMARC Checker questions.

What does this checker do?

It looks up a domain's public email records (MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI), checks them against the standards and the Gmail, Yahoo and Microsoft sender rules, and explains anything that needs fixing.

What is an SPF record?

A TXT record on your domain that starts with v=spf1 and lists the servers allowed to send email for it, directly (ip4, ip6) or through includes from your email services. It ends with ~all or -all to say what to do with everything else.

Which DMARC policy should I use?

Start with p=none and a rua address so you get reports without affecting delivery. When the reports show that all your real email passes, move to p=quarantine and then p=reject, which stops others sending email as your domain.

How do I find my DKIM selector?

Open an email you sent, show its headers and find the DKIM-Signature line: the selector is the value after s=, and the domain after d=. Common ones are google for Google Workspace and selector1 or selector2 for Microsoft 365.

Why does SPF have a 10 lookup limit?

Each include, a, mx, exists and redirect makes receivers look up more DNS records. To stop that being abused, the SPF standard (RFC 7208) allows 10. Above that, SPF fails for every email, so remove includes for services you no longer use.

What do Gmail and Yahoo require from senders?

Every sender needs SPF or DKIM and a valid reverse DNS. Senders of more than 5,000 emails a day need SPF, DKIM and DMARC (p=none is enough), a From domain that aligns with SPF or DKIM, one-click unsubscribe, and a spam complaint rate under 0.3%.

Is the check private?

Only the domain name is looked up, through Cloudflare's public DNS, as any mail server would. Nothing is sent to our servers and nothing is stored.

Next steps

More free mail tools

Email Header Analyzer

See why one email passed or failed.

HeadersVerdict

EML Viewer

Open a saved .eml email with its attachments.

ViewEML

MSG Viewer

Open an Outlook .msg email without Outlook.

ViewMSG