How to use
- Enter a domain, or paste an email address (the part after @ is used).
- Click Look up to see the MX, SPF, DKIM and DMARC results. If no DKIM key is found, enter your selector and look up again.
- Fix the records at your DNS provider as suggested, then check again once they take effect.
Options explained
- SPF
- A TXT record at the domain root starting with v=spf1 that lists the servers allowed to send as the domain. There must be only one.
- DMARC
- A TXT record at _dmarc starting with v=DMARC1 that tells receivers what to do when SPF and DKIM checks fail.
- Lookup count
- Each include, a, mx, ptr, exists and redirect in SPF costs a DNS lookup, and the total must not exceed 10. Includes and redirects are expanded, so nested lookups are counted too.
Reading the records
An SPF record is a list of terms. Each term can start with a qualifier that says what happens when it matches (RFC 7208):
| Qualifier | Meaning | Example |
|---|---|---|
+ (default) |
Pass | a or +a |
- |
Fail: reject | -all |
~ |
Softfail: accept but mark | ~all |
? |
Neutral: no statement | ?all |
The checker reports +all (or a bare all) as allowing every server to send, ?all as doing nothing against spoofing, and a record with no all or redirect= as unfinished. It also warns about the ptr mechanism and about a second SPF record.
A DMARC record is a set of tag=value pairs separated by semicolons (RFC 7489):
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=s; pct=100| Tag | Meaning |
|---|---|
v |
Version, always DMARC1 and first in the record |
p |
Policy for the domain: none, quarantine or reject |
sp |
Policy for subdomains; if absent, p applies |
rua |
Where to send aggregate reports |
ruf |
Where to send failure reports |
pct |
Share of failing mail the policy applies to; 100 if absent |
adkim, aspf |
DKIM and SPF alignment: r relaxed (default) or s strict |
fo |
Failure report options; 0 if absent |
A DMARC record without rua is flagged because you would get no reports. On the DKIM side, an RSA key shorter than 2048 bits is flagged as weak, and a key whose p= value is empty is shown as Revoked.
Frequently asked questions
Should SPF end with ~all or -all?
-all tells receivers to reject unlisted servers; ~all marks them as suspicious. Use ~all until you are sure the list is complete. With DMARC in place the difference is small.
Which DMARC policy should I start with?
Start with p=none and a rua address, watch the reports for a week or two to make sure every legitimate sender passes, then move to quarantine and finally reject.
Why is no DKIM key found?
DKIM keys live at selector._domainkey.domain, and the selector is chosen by your mail provider. Common selectors such as default, selector1, selector2 and google are tried automatically; otherwise find the s= value in a message’s DKIM-Signature header and enter it as the DKIM selector.
Privacy
This tool needs our server: what you enter or upload is sent over HTTPS, processed and then discarded, never stored. Server access logs record IP addresses and request URLs, used only to prevent abuse.