Skip to content

Tool 05·Free

SPF · DKIM · DMARC · MX

SPF, DKIM and DMARC Checker (Free)

Enter your domain and check its SPF, DKIM and DMARC records in one go. If something's wrong, the tool explains it in plain language, and the “Build records” tab generates corrected SPF and DMARC records. Below the tool you'll find where and how to add them, step by step.

You can also paste your website URL or company email address.

DKIM selector (optional)

The selector is the name of your provider's DKIM key. Enter it if you know it; otherwise common selectors are tried.

Your domain and the related record names are sent to a public DNS query service. DNS changes may not show up immediately because of caching.

What does this check show? The tool inspects your domain’s public DNS records. Finding the records doesn’t mean every email you send passes authentication or reaches the inbox. To check a real message, look at the email headers on the receiving side too.

What Are SPF, DKIM and DMARC?

These three records prove to the receiving mail server that your email really comes from you. When they're missing or wrong, your mail may land in spam or not be delivered at all, and fake mail spoofing your domain isn't blocked.

SPF

A TXT record listing which servers and services may send email for your domain.

DKIM

A digital signature added to outgoing mail. The receiver verifies it with the public key in your DNS.

DMARC

Says what to do with mail that fails SPF and DKIM, and sends you reports.

How to Create an SPF Record

An SPF record is a TXT record on your domain itself (@) that starts with v=spf1. Every service you send mail through goes into the record, and it ends with an “all” term. For example, if you send from Google Workspace and your hosting server:

v=spf1 include:_spf.google.com a mx ~all

1️⃣
One record. A domain must have exactly one SPF record. When you add a service, don't create a second record; add an include: to the existing one.
🔟
10 DNS lookups at most. include, a, mx, exists and redirect each need a DNS lookup, and lookups inside includes count too. Past 10, SPF checks fail. The tool counts them for you.
〰️
~all or -all? ~all gives unlisted sources an SPF “softfail”; -all gives them a “fail”. Whether the email is accepted, sent to spam or rejected is the receiving server’s decision. Verify all your legitimate sending sources before choosing. Never use +all; it authorises every sending IP.

How to Create a DMARC Record

A DMARC record is a TXT record named _dmarc. The simplest version:

v=DMARC1; p=none; rua=mailto:dmarc@company.com

  1. Start with p=none. Your mail isn't affected; reports showing who sends mail as your domain arrive at the rua address.
  2. Review the reports. Make sure every service you use passes SPF or DKIM. Fix any legitimate service that fails first.
  3. Choose a policy that fits your use. p=quarantine asks receivers to treat failing mail as suspicious; p=reject asks them to reject it. p=reject isn’t the right next step for everyone: legitimate mail relayed through forwarding and mailing lists can be affected. Decide based on reports and real sending tests.

Tip: Google recommends setting up SPF and DKIM before DMARC and having them in place for at least 48 hours. That wait doesn’t prove all your sending is configured correctly; review the reports too.

How to Turn On DKIM

Your email provider generates the DKIM key and gives you the record to add to DNS. The three most common setups:

cPanel (hosting email)

In cPanel, open Email Deliverability in the Email section and click Manage next to your domain. cPanel shows the suggested DKIM and SPF records; if your DNS is on the same server you can install them with one click. If your DNS is elsewhere (Cloudflare, for example), add the record there as a TXT record.

Google Workspace

In the Admin console, go to Apps > Google Workspace > Gmail > Authenticate email, generate a new DKIM record and add the google._domainkey record to your DNS. Once it has propagated, click Start authentication on the same screen.

Microsoft 365

In the Microsoft Defender portal, open the DKIM tab under email authentication settings and select your domain. Add the two CNAME records Microsoft gives you (selector1._domainkey and selector2._domainkey) to your DNS, then turn on DKIM signing.

Other services (Brevo, SendGrid, Mailgun and so on) provide their DKIM records in their own dashboards during domain verification.

How to Add a Record to DNS

Records go wherever your domain's DNS is managed: your hosting panel (Zone Editor in cPanel), your domain registrar's panel, or a DNS service like Cloudflare.

  1. Add a new TXT record in the DNS settings.
  2. In Name / Host, enter @ (or leave it empty) for SPF and _dmarc for DMARC. Some panels append the domain automatically, so enter just _dmarc rather than _dmarc.company.com.
  3. Paste the value you copied from the tool into Value and save.
  4. Wait anywhere from a few minutes to a few hours, then check again with the tool above.

Gmail and Yahoo Sender Requirements

Everyone sending to personal Gmail accounts (@gmail.com and @googlemail.com) needs SPF or DKIM. Bulk senders that send roughly 5,000 or more messages a day to these accounts from the same primary domain need SPF, DKIM and DMARC together, plus one-click unsubscribe for marketing mail and a low spam rate. Yahoo also requires SPF, DKIM and DMARC from bulk senders; don’t assume Google’s 5,000 threshold applies to Yahoo. This tool checks DNS records; check the other sender requirements separately. Details: Google’s email sender guidelines and Yahoo’s sender best practices.

Common Mistakes

✕
Two separate SPF records. Creating a second v=spf1 record for a new service breaks SPF. Merge them into one.
✕
Going over 10 lookups. Includes for services you stopped using years ago are the most common reason.
✕
Starting DMARC at reject. Jumping to p=reject without reading reports can get legitimate mail from a forgotten service rejected.
✕
Adding the record in the wrong place. Putting DMARC on the domain itself instead of _dmarc, or doubling the domain in the Name field (_dmarc.company.com.company.com).

If your records are correct and mail still lands in spam, the cause may be content or sender reputation: try the email spam checker and my guide on keeping emails out of spam.

Privacy and Use

🔒 No email password needed
🌐 Public DNS records are queried
🚫 No email content to upload
📋 Copy records with one click

Get Your Email to the Inbox

Check your technical records, then test your email content for spam triggers.

🛡️ Check My Domain ✉️ Spam Checker

Frequently Asked Questions

How do I check my SPF record?

Enter your domain in the tool above and click “Check”. It finds the TXT record starting with v=spf1 and shows whether it's the only one, whether it exceeds the 10 DNS lookup limit and which “all” setting it ends with.

What's the difference between SPF, DKIM and DMARC?

SPF lists which servers may send email for your domain. DKIM adds a digital signature to outgoing mail that shows it wasn't changed in transit. DMARC looks at the SPF and DKIM results, says what to do with mail that fails, and sends you reports.

Can a domain have more than one SPF record?

No. A domain must have exactly one SPF record; more than one makes SPF checks fail. If you use several services, list them all in one record with include:.

Should I start DMARC with p=none?

New setups usually start with p=none: your mail isn't affected and you only receive reports. Once the reports show your legitimate mail passing SPF and DKIM, move to p=quarantine and then p=reject.

Can I generate a DKIM record with this tool?

No. Your email provider generates the DKIM key; the private key stays with them and you only get the record to add to DNS. This page explains how to turn on DKIM in cPanel, Google Workspace and Microsoft 365.

I added the record but the tool can't see it. Why?

DNS changes can take from a few minutes to a few hours to propagate, depending on the record's TTL. Wait a while and check again. Make sure the record is in the right place: SPF on the domain itself (@), DMARC on _dmarc.

What information is shared during a check?

Your domain and the related record names are sent to a DNS query service (Google Public DNS, or Cloudflare if Google doesn’t answer). These can include the _dmarc name, DKIM selectors and other domains referenced in your records. You don’t need to enter your email password or message content. The site’s Google Analytics only receives that a check ran and the result types (for example “SPF: problem found”); your domain isn’t added to that record or to the page address.

Sources: Google — Email sender guidelines · Yahoo — Sender best practices · RFC 7208 — SPF · RFC 6376 — DKIM · RFC 9989 — DMARC