DMARC & SPF checker

Find out if your email can be spoofed or sent to spam, and get the exact record to fix it.

What are SPF, DKIM and DMARC?

Email was designed without any way to check who really sent a message, so anyone can put your address in the From line. Three DNS records fix that, and mail providers like Gmail and Outlook now expect all of them from anyone sending email.

  • SPF is a TXT record at your domain listing the servers allowed to send email as you, like v=spf1 include:_spf.google.com ~all. The ending says what to do with everyone else: -all rejects, ~all marks as suspicious, ?all does nothing.
  • DKIM signs each message with a key published in DNS, so receivers can check it wasn't forged or changed. Your email provider gives you the record to add.
  • DMARC is a TXT record at _dmarc.yourdomain that tells receivers what to do when a message fails SPF and DKIM, and where to send reports. p=none only monitors, p=quarantine sends failures to spam and p=reject refuses them.

How to set up DMARC safely

  1. Make sure SPF and DKIM are set up for every service that sends as you: your mailbox provider, newsletter tool, invoicing and your website's contact form.
  2. Add v=DMARC1; p=none; rua=mailto:you@yourdomain and read the reports for a couple of weeks.
  3. Once only your real senders show up as passing, move to p=quarantine, then p=reject.

Common problems

  • Two SPF records. A domain may have only one. With two, receivers ignore both. Merge them.
  • Too many lookups. SPF allows at most 10 DNS lookups (each include: counts), and long chains of includes go over it.
  • DKIM at an unusual selector. We check the common selectors; your provider may use its own, so "not found" here doesn't always mean it's missing.

More free tools

  • Full check: Free, instant, no sign-up. See what's wrong in plain English.
  • SSL checker: See when a certificate expires, who issued it and whether browsers trust it.
  • DNS lookup: Every record for a domain, with what each one does.
  • Is it down?: We'll check the site right now from our servers, not your network.
  • Domain expiry: When a domain expires and where it's registered, straight from the registry.