ENTER A SENDING DOMAIN TO CHECK SPF, DKIM, DMARC AND MX
Lookups run in your browser through Google Public DNS. Nothing is stored and nothing is sent to us.
What the checker looks at
Three records decide whether mailbox providers trust email from your domain. SPF lists the servers allowed to send for you. DKIM signs every message so the receiver can tell it was not changed on the way. DMARC tells receivers what to do when a message fails both, and sends you reports about who is sending in your name. Since 2024, Gmail and Yahoo require all three for bulk senders, and cold email domains are judged the same way.
- SPF: exactly one record, ending in ~all or -all, under the 10-lookup limit.
- DKIM: a published key for the selector your provider signs with.
- DMARC: a policy, ideally moving from p=none to quarantine or reject, with reports turned on.
- MX: somewhere for replies to land, which matters more than most teams think for outbound domains.
Authentication is one layer of a sending setup. How it fits with domains, inboxes, warmup and monitoring is in outbound infrastructure architecture, and you can size the whole setup with the domains and inboxes calculator.
FROM THE YARD
The failure we see most is two SPF records on one domain, usually after someone adds a new sending tool and pastes its record instead of merging it. Both records then fail, and nobody notices until replies drop. Check every new domain before it sends anything.
Questions about SPF, DKIM and DMARC
Do I need all three for cold email?
Yes. Without SPF and DKIM, mailbox providers have no way to confirm the email is really from you. Without DMARC, Gmail and Yahoo treat bulk mail as suspicious. Missing any of them pushes mail toward spam.
Why does the checker not find my DKIM key?
DKIM keys live at a selector chosen by your mail provider. The checker tries the common ones. If yours is custom, find it in your provider's DKIM settings or in the s= value of a sent email's header and enter it in the selector field.
Should DMARC be set to reject?
Eventually, yes. Start with p=none and reports turned on, check that all your real senders pass, then move to quarantine and finally reject. Jumping straight to reject can block your own legitimate mail.