About this tool
Do your e-mails end up in spam, or do scammers send mail in your name? Whether a domain is protected against spoofing and delivered reliably is decided in its DNS records: SPF defines which servers may send, DKIM signs the messages and DMARC tells receivers what to do with suspicious mail. Since 2024, Gmail and Yahoo require these records from bulk senders.
The check queries all relevant records – MX, SPF (including a recursive count of DNS lookups), DMARC, DKIM, MTA-STS, TLS-RPT and BIMI – and explains what is missing or could be improved. The queries run via DNS over HTTPS directly from your browser. Single DNS records are shown by the DNS Lookup; the domain’s registrar and name servers by the WHOIS / RDAP Lookup.
How it works
- Enter a domain or an e-mail address.
- Optionally enter your DKIM selector – it is in the header of a sent mail under “DKIM-Signature: … s=”.
- Click “Check”.
- Read the rating and tips for every area and adjust your DNS records.
Frequently asked questions
What is the difference between SPF, DKIM and DMARC?
SPF is a list of allowed sending servers. DKIM is a digital signature of every mail whose public key is published in DNS. DMARC ties both to the visible sender address and defines whether receivers accept, quarantine or reject failing mail – and where they send reports.
Why doesn’t the tool find my DKIM key?
DKIM keys live under a freely chosen selector (e.g. selector1._domainkey.example.com), and the list of selectors cannot be queried from DNS. The tool tries common names used by Microsoft 365, Google, Mailchimp and others. If yours is not found, enter it manually – it is in the DKIM-Signature header of your mails after “s=”.
What does the limit of 10 DNS lookups for SPF mean?
Every include:, a, mx, ptr, exists and redirect= costs the receiver a DNS query, and included records count too. More than ten is an error according to RFC 7208, and the SPF record is then often ignored. Removing services you no longer use or listing IP ranges directly helps.
Which DMARC policy should I use?
Start with p=none and an rua address to collect reports. Once all legitimate senders pass SPF or DKIM, switch to p=quarantine and finally to p=reject. Only then is your domain effectively protected against spoofing.