SPF, DKIM and DMARC Checker
Email from your domain landing in spam, or being rejected? Enter your domain to check the records that prove your messages are genuine: MX, SPF, DMARC and, if you know the selector, DKIM.
When you press the button, your browser sends the domain you typed to Cloudflare’s public DNS-over-HTTPS service (with Google’s as a backup). CHECKiOX does not see or store it. See our privacy policy.
What each record does
- MX says which servers receive email for your domain. Without it, nobody can email you.
- SPF lists the servers allowed to send email as your domain. Receivers use it to spot forged mail.
- DKIM adds a digital signature to each message. The public key sits in DNS under a name your mail provider gives you, called the selector.
- DMARC tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. The policy can be none (only monitor), quarantine (send to spam) or reject (refuse).
What this checker looks for
- SPF: exactly one record, at most 10 DNS lookups, and an ending of
-allor~all. It flags+all(allows anyone),?all, multiple records and the discouragedptrmechanism. - DMARC: a valid policy, a single record, a reporting address, and whether the policy still only monitors.
- DKIM: whether a public key is published for the selector you enter, and whether it has been revoked.
How to set up email authentication
- Get the SPF and DKIM details from your email provider. They publish the exact records to add.
- Add one SPF record that includes every service that sends mail for you.
- Turn on DKIM signing at your provider and publish the key they give you.
- Start DMARC with
p=noneand a reporting address, watch the reports, then move toquarantineand finallyreject.
Records are changed at your domain’s DNS provider, and a change can take a while to spread. To see the raw records, use the DNS lookup.
About this tool
This is a quick review of the public records, not a full deliverability test. Passing all three checks does not guarantee inbox placement, but missing or broken records are a common reason mail goes to spam. DKIM can only be checked if you enter the selector, because it is not listed anywhere publicly.
Frequently asked questions
How do I check my SPF record?
Enter your domain above. The checker finds your SPF record and tells you whether there is exactly one, whether it ends in -all or ~all, and whether it needs more than 10 DNS lookups.
What is DMARC and do I need it?
DMARC tells receiving mail servers what to do with mail that fails SPF and DKIM checks and where to send reports. Large mailbox providers now require it from bulk senders and it improves delivery for everyone, so yes, it is worth publishing.
What is a DKIM selector?
A selector is a name your email provider gives you, such as google or selector1. The DKIM public key is published at selector._domainkey.yourdomain. Enter it above to check that the key is present.
Why does my email go to spam?
Missing or broken SPF, DKIM and DMARC records are a common cause, along with a poor sender reputation and content that looks like spam. Fix the records first, since they are quick to check.
What does SPF -all versus ~all mean?
-all tells receivers to reject mail from servers not listed in the record. ~all tells them to treat it with suspicion but usually accept it. Both are valid; -all is stricter.
Related tools and guides
- DNS lookup: see the raw records.
- SSL certificate checker: check a site's certificate.
- Is it down? Website checker: does a site answer.
- All tools: every CHECKiOX tool in one place.