SPF, DKIM & DMARC Checker
Read your domain's email authentication records from live DNS. Check the SPF lookup limit, DKIM key length and DMARC policy, and generate the missing records ready to paste into your DNS panel.
SPF, DKIM and DMARC Guide
If your emails land in the spam folder, the problem is usually not the content but DNS. This tool queries your domain's SPF, DKIM, DMARC and MX records live, explains the errors in plain English and generates the missing records ready to paste into your DNS panel. Below I summarize what the three records do and the Gmail, Yahoo and Outlook rules.
Three records, three different questions
SPF answers "may this server send on behalf of this domain?" and lives in the v=spf1 TXT record on the root domain. DKIM proves with a cryptographic signature that the email was not changed in transit; the public key sits at selector._domainkey.example.com. DMARC checks whether SPF or DKIM aligns with the visible From address and says what to do with email that fails authentication (none, quarantine, reject).
Gmail, Yahoo and Outlook rules
Since February 2024, Gmail and Yahoo require senders of more than 5,000 emails a day to have SPF, DKIM, a DMARC record with at least a p=none policy, and From alignment. Outlook introduced the same requirement on 5 May 2025. Gmail also requires a DKIM key of at least 1024 bits and recommends 2048 bits. The tool estimates the key length from the record and checks this threshold.
The SPF limit of 10 DNS lookups
RFC 7208 allows at most 10 DNS lookups when evaluating SPF. Every include, a, mx and redirect counts as one lookup, and nested includes add to the total. If the limit is exceeded, the receiver returns a permerror and SPF is treated as if it did not exist. The tool follows the include chain and shows the total. Having two separate v=spf1 records on the same domain is another common mistake; merge them into a single record.
A safe rollout to DMARC
Starting straight with p=reject can make you lose email from an invoicing or newsletter service you forgot about. Collect reports for 2–4 weeks with p=none and a rua address, add every legitimate source to SPF and DKIM, then move to quarantine and finally to reject. During a gradual rollout, the pct tag lets you apply the policy to only part of your email.
The rest of the infrastructure
To harden the web side of your domain too, generate HTTP security headers with Security Headers & CSP Generator. To keep a constant eye on whether your site and email infrastructure are up, see Uptime Monitoring.