SPF, DKIM and DMARC, explained for your domain
Enter a domain. We look up its authentication records live and explain every part in plain words, with the exact change to make.
Check a domain
What the three records do
- SPF
- A TXT record listing the servers allowed to send mail for your domain. Receivers compare the sending server with it.
- DKIM
- A signature on every email, checked against a public key in your DNS. It proves the email wasn’t changed and came from your domain.
- DMARC
- Tells receivers what to do when SPF and DKIM don’t match the From address (nothing, spam folder, or reject), and where to send daily reports.
Sources
- RFC 7208: Sender Policy Framework (10-lookup limit, §4.6.4), read 8 November 2026.
- Google: Email sender guidelines (DKIM 1024-bit minimum, DMARC for bulk senders), read 8 November 2026.
Want MX and tracking records too? Use the domain checker. Worried about blocklists? Try the blacklist checker.
Part of Deliverability suite in Inboxed. Placement tests with Gmail tabs, DMARC reports, Postmaster spam rate, blocklist and DNS checks.
See Deliverability suiteStart freeQuestions
What does this checker look up?
The domain’s SPF record (and the records it includes, to count DNS lookups), DKIM keys on common selectors plus one you type, and its DMARC record. Each part is explained, with what to change.
Why does the SPF lookup count matter?
SPF allows at most 10 DNS lookups (include, a, mx, ptr, exists and redirect). Above that, receivers must stop and treat SPF as an error, so it fails even though the record looks fine.
It says no DKIM key, but I set one up.
DKIM keys live under a selector name your provider picks. We try common ones (google, selector1, selector2, default, k1, s1, s2, dkim, mail, smtp). Find yours in the DKIM-Signature header (s=…) of an email you sent and enter it in the selector box.
What DMARC policy should I use?
Start with p=none and a rua address so you get reports. Once the reports show your mail passing SPF or DKIM, move to p=quarantine, then p=reject. Gmail and Yahoo accept p=none from bulk senders.
Do you store the domains I check?
No. Answers are cached in memory for ten minutes so repeated checks don’t hit DNS again, then forgotten.
Is there a limit?
15 checks per network every 10 minutes, so the tool stays fast and can’t be used to flood DNS.
Warm up today. Launch when you’re ready. Pay only for emails that send.
No subscription, no card to start. Connect a mailbox and warmup begins in under a minute.