Free email tool
SPF and DMARC check for your domain
This SPF and DMARC check shows in seconds whether other mail servers can trust email from your domain. Enter your domain and you see your SPF record and the DNS lookups it uses, your DMARC policy and report address, and whether a DKIM key is published on the common selectors.
Free, no account needed
Is my email set up correctly?
Your email is set up well when your domain has exactly one valid SPF record, a DMARC record on _dmarc with a policy of quarantine or reject, and DKIM signing from your mail provider. SPF names the servers that may send for your domain, DKIM signs each message and DMARC tells receivers what to do when a message fails. Missing records make it easier to fake your address and can push your real mail into spam.
What this check looks at
The tool reads the public DNS records of your domain, the same records a receiving mail server reads when your email arrives. Nothing is sent from your mailbox and you do not need to log in anywhere.
You get three result cards: one for SPF, one for DMARC and one for DKIM. Each card is green, orange or red, and shows the record we found with a short explanation of any problem.
- SPF: whether a record exists, whether it is valid and how many of the 10 allowed DNS lookups it uses
- SPF: more than one record, syntax errors, includes that point to a domain without SPF, the outdated ptr mechanism and how the record ends (~all, -all, ?all or +all)
- DMARC: whether a record exists on _dmarc, which policy it sets and which report addresses (rua) it lists
- DMARC: more than one record, an invalid policy, a missing report address and a pct value below 100
- DKIM: whether a key is published on the common selectors
How to read the result
Green means the record is there and the tool found no problems. Orange means it works but leaves a gap, for example a DMARC policy of none or no DKIM key on the selectors we tried. Red means the record is missing or broken, so receivers cannot use it.
SPF only counts as valid when it stays within 10 DNS lookups. Every include, a, mx, ptr and exists term and the redirect modifier counts, and includes inside an include count too. Above 10 the result is a permanent error, which receivers handle as if SPF failed. ip4 and ip6 entries use no lookups.
The ending of your SPF record decides what happens to mail from servers that are not listed. -all asks receivers to fail it, ~all asks them to accept but mark it (softfail), ?all says nothing and +all lets every server in the world send for you. A record without an all at the end behaves like ?all.
For DMARC, none only collects reports, quarantine asks receivers to treat failing mail as suspicious (usually the spam folder) and reject asks them to refuse it.
Common mistakes
Most problems come from adding a new email service without cleaning up the old setup.
- Two SPF records on one domain, for example one from your web host and one from your newsletter tool. Receivers then return an error and SPF counts for nothing. Merge them into one record.
- Too many includes. Each sending service adds its own include, and some of those contain more includes, so you pass 10 lookups sooner than you think.
- A record ending in +all or ?all, which protects nothing.
- A DMARC record that stays on p=none for years, so faked mail still gets delivered.
- No report address (rua) in DMARC, so you never see which servers send mail in your name.
- Putting the DMARC record on the domain itself instead of on _dmarc.yourdomain.
- Assuming DKIM is missing because the check found no key. The tool tries the common selectors only, so a provider with its own selector name can still sign your mail. Ask your provider which selector they use.
What to do next
Fix red cards first. If SPF is missing or broken, build one clean record with the SPF generator and replace the old one at your DNS provider. If DMARC is missing, publish a record with p=none and a report address, read the reports for a few weeks, and move to quarantine and then reject once all your real mail passes. That gradual route is also what the DMARC standard describes for domain owners.
If you send more than 5,000 messages a day to Gmail addresses, Google requires SPF, DKIM and DMARC (a policy of none is enough) and a From domain that aligns with SPF or DKIM. All other senders need at least SPF or DKIM.
DNS changes take a while to spread, often a few hours. Run the check again after that to confirm the new record is live.
How to use the check
-
Enter your domain
Type the domain you send email from, for example yourbusiness.com, without https:// or www.
-
Read the three cards
Start with the red cards, then the orange ones. Each card shows the record we found and what the problem means.
-
Fix and check again
Change the record at your DNS provider, wait a few hours and run the check again to confirm.
Frequently asked questions
What is the difference between SPF, DKIM and DMARC?
SPF is a list in DNS of the servers that may send email for your domain. DKIM adds a digital signature to each message, which receivers check with a public key in your DNS. DMARC ties them together: it checks that SPF or DKIM passes for the domain in the visible From address and tells receivers what to do when neither does.
Why must my SPF record stay within 10 lookups?
The SPF standard (RFC 7208) limits the include, a, mx, ptr and exists terms and the redirect modifier to 10 per check. Above that the result is a permanent error and receivers handle your mail as if SPF failed. Remove services you no longer use, or ask a provider for fixed ip4 or ip6 addresses, which use no lookups.
Should I use ~all or -all?
~all (softfail) is a safe start while you are still finding every service that sends for you. Once every real sender is in the record, -all gives the clearest signal. Microsoft, for example, recommends -all for domains that also use DKIM and DMARC.
My domain has two SPF records. Is that a problem?
Yes. A domain may only have one SPF record. With two, receivers return an error and ignore SPF. Combine the entries of both into one record that starts with v=spf1 and ends with a single all.
The check finds no DKIM key. Is DKIM missing?
Not necessarily. A DKIM key lives under a selector name that each provider chooses, and the tool tries the common ones. Ask your mail provider for the selector and the DKIM record, and add it if it is not there yet.
Does SitePack set these records up for me?
For domains managed at SitePack, the SPF and DKIM records for your SitePack email are created for you. A DMARC record you add yourself in the DNS records of your domain, with DNS management included for free.
Related tools and guides
- SPF generator Build one valid SPF record for every service you send with.
- DMARC generator Create a DMARC record with the policy and report address you choose.
- Email on your own domain Set up an address like you@yourbusiness.com in three steps.
- Business email at SitePack A 5 GB mailbox with every package, extra mailboxes from €3.25 a month.
- Free tools
Business email that is set up right
A website from €15 a month, billed yearly, with your own domain, a 5 GB mailbox and SPF and DKIM set up for you. Try it free for 14 days, no payment details needed.