Skip to content
Devtoolry
Sign InJoin for Free

SPF, DKIM & DMARC Checker

Check a domain's email authentication: SPF syntax and the 10-lookup limit, DKIM keys at common selectors, DMARC policy and reports, plus MX, MTA-STS and BIMI.

Something not working, or missing a feature? Send feedback

About the SPF, DKIM & DMARC Checker

The SPF, DKIM & DMARC Checker tests the DNS records that stop people sending email in your domain's name. It checks the SPF record's syntax, its final all mechanism and the 10-DNS-lookup limit counted through every nested include. It looks for DKIM keys at about 35 common selectors (or yours) and estimates their key length. It reads the DMARC policy, reporting address and subdomain policy, and also shows MX, MTA-STS, TLS reporting and BIMI.

Our server sends the DNS queries (TXT and MX records) to a public resolver, so your own address is not shared with it. Domain names and results are not stored.

How to use the SPF, DKIM & DMARC Checker

  1. Enter your domain, or paste an email address and the domain is taken from it.
  2. If you know your DKIM selector (from a received email's DKIM-Signature header, s=…), enter it.
  3. Read the score and fix the failed checks first: missing records, more than 10 SPF lookups, +all.
  4. Once DMARC reports show only your own mail servers, move the policy from p=none to quarantine and then reject.

Works well with the SPF, DKIM & DMARC Checker

Frequently asked questions

What are SPF, DKIM and DMARC?

SPF is a TXT record listing the servers allowed to send mail for your domain. DKIM adds a cryptographic signature to each message, checked against a public key in DNS. DMARC tells receivers what to do when a message fails both (nothing, spam folder or reject) and where to send reports. Together they stop spoofing and help deliverability.

Are they required now?

For bulk senders, yes: since February 2024 Gmail and Yahoo require SPF, DKIM and a DMARC record (p=none is enough to start) from anyone sending about 5,000 or more messages a day to their users. Smaller senders need at least SPF or DKIM, and everyone gets better delivery with all three.

What is the SPF 10-lookup limit?

RFC 7208 allows an SPF check to make at most 10 DNS lookups: every include, a, mx, ptr, exists and redirect counts, including those inside included records. Above 10 the result is a permanent error, as if you had no SPF. Remove services you no longer use or replace includes with ip4/ip6 ranges.

Why does it say no DKIM key was found?

DKIM keys live at selector._domainkey.yourdomain, and the selector can be any name. We try the common ones (google, selector1, selector2, k1, s1 and so on). If yours is different, open an email you sent, find s= in the DKIM-Signature header, and enter it.

Related tools