SPF, DKIM and DMARC checker
Gmail and Yahoo since 2024, and Microsoft since 2025, require bulk senders to authenticate their mail, and every provider treats unauthenticated mail with more suspicion. Enter your domain to see whether SPF, DKIM and DMARC are in place.
What it checks
What this tool checks
Email authentication
- MX records. Which servers receive mail for the domain.
- SPF. One record that lists the servers allowed to send as you.
- DKIM. A signing key under the 20 most common selector names.
- DMARC. A policy telling receivers what to do with mail that fails the checks.
Security and HTTPSalso checked
- HTTPS and redirect. The site loads securely, and http:// addresses forward to https://.
- Certificate. Trusted, matching the domain, and how many days until it expires.
- TLS version. TLS 1.2 or 1.3; older versions are refused by current browsers.
- Security headers. HSTS, content type, framing, referrer and content security policies.
Search basicsalso checked
- Title and description. Present, and a length that fits in search results.
- Headings and language. One H1, and the page language declared.
- Mobile viewport. Phones get the mobile layout, which Google uses for ranking.
- Canonical and indexing. No accidental noindex, and one preferred address per page.
- robots.txt and sitemap. Crawlers are let in and can find every page.
- Sharing preview. Open Graph title and image for links shared on social apps.
Speedalso checked
- Server response. Time to the first byte, measured from our server.
- Compression. Gzip or Brotli on the HTML.
- Mobile speed score. Google Lighthouse on a simulated mid-range phone.
- Core Web Vitals. Largest Contentful Paint, layout shift and main-thread blocking.
What SPF, DKIM and DMARC do
SPF is a DNS record that lists the servers allowed to send mail for your domain. A receiving server compares the sending server's address against that list.
DKIM adds a signature to every message. The receiver fetches your public key from DNS and confirms the message was sent by you and was not changed on the way.
DMARC ties the two together. It tells receivers what to do when a message claiming to be from your domain fails both checks, and where to send reports about it. Without DMARC, anyone can send mail that appears to come from your address.
When mail goes to spam
Missing or broken authentication is a common reason legitimate business mail ends up in spam. The usual culprits are a second SPF record added by a new tool, a newsletter or CRM service that was never set up to sign with DKIM, or no DMARC record at all.
FAQ
Frequently asked questions
Why can the checker not find my DKIM key?
DKIM keys are published under a selector name that each provider chooses, such as google or selector1. The checker tries the 20 most common names. If your provider uses another one, the key may exist without the checker seeing it. The selector appears as s= in the DKIM-Signature header of any email you have sent.
Which DMARC policy should I use?
Start with p=none and a reporting address, and read the reports for two to four weeks. Once every service that sends as you passes SPF or DKIM, move to p=quarantine and then p=reject.
Can I have two SPF records?
No. Receivers treat two SPF records as an error and ignore both. Merge them into a single record with all the include: entries.
Do I need all three?
Yes, for reliable delivery. SPF and DKIM prove a message is yours, and DMARC is what makes receivers act on that proof. Large providers check for all three.
Free tools