Free SPF, DKIM & DMARC checker
Check whether a domain's email setup will land in the inbox. Get an A–F grade, the exact records we found, and plain-English fixes you can paste into your DNS.
Works with a domain, an email address or a website URL. Lookups happen in your browser; nothing is stored.
Checking a list of domains?
Audit hundreds or thousands of domains at once, export to CSV/Excel/JSON, call it from an API, or run it on a schedule. Useful for agencies, IT consultants and cold-email teams. $8 per 1,000 domains, no subscription.
Run the bulk checker on ApifyNeed to fix something? Use the free SPF record generator and DMARC record generator, or read how to fix "SPF too many DNS lookups" and how to move DMARC to p=reject.
What this checker looks at
SPF: that there's exactly one record, how it ends (-all, ~all, ?all or the dangerous +all), and that it stays under the 10-DNS-lookup limit (counted through every include). DMARC: whether a policy exists, how strict it is (none / quarantine / reject), and whether reports go anywhere. DKIM: over 40 common selectors from Google Workspace, Microsoft 365, Mailchimp, SendGrid, Amazon SES and more, while spotting revoked keys and wildcard DNS. Plus MTA-STS, TLS-RPT and BIMI.
FAQ
What are SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for your domain. DKIM signs each message with a key published in DNS. DMARC tells receivers what to do when a message fails those checks, and where to send reports. Together they stop spoofing and help your mail reach the inbox.
What do Gmail and Yahoo require from bulk senders?
Since 2024, anyone sending more than 5,000 messages a day to Gmail or Yahoo needs SPF and DKIM, a DMARC record (at least p=none), a From domain aligned with SPF or DKIM, one-click unsubscribe, and a low spam-complaint rate. This checker confirms the DNS part.
Why does it say DKIM wasn't found when I have DKIM?
DKIM keys live under a "selector" name that can't be listed from DNS, so every checker has to guess. We try over 40 common ones. If your provider uses a custom selector, send yourself an email and look for s= in the DKIM-Signature header.
How is the grade calculated?
Out of 100 points: SPF 30, DMARC 40 (a reject policy scores highest), DKIM 20, and 10 for MTA-STS, TLS-RPT and BIMI. A = 90+, B = 75+, C = 60+, D = 40+, F below 40.
Is it free? Do you store my data?
It's free, with no sign-up. Lookups run in your browser through public DNS-over-HTTPS (Cloudflare, with Google as backup), which see only the DNS names being looked up. This site doesn't store or log what you check.