How it works
Enter your domain (and optionally a DKIM selector) and the checker fetches the SPF, DKIM and DMARC records via DNS-over-HTTPS — entirely in your browser. Each record is parsed and rated so you can spot misconfigurations at a glance. Step-by-step setup instructions are in our SPF, DKIM & DMARC setup guide.
What these records do
SPF (Sender Policy Framework) lists which servers are authorized to send email as your domain. It's a TXT record on your root domain that starts with v=spf1.
DKIM can cryptographically sign outgoing messages. A published DNS key alone does not prove that messages are actually signed correctly.
DMARC passes when at least one of SPF or DKIM passes with its authenticated domain aligned to the visible From domain. The published policy expresses the domain owner’s preference; receivers decide delivery.
Why all three matter
- Gmail & Yahoo require DKIM + SPF + DMARC for bulk senders (5,000+/day) since Feb 2024
- Without authentication, your messages are more likely to land in spam
- DMARC passes when at least one of SPF or DKIM passes with its authenticated domain aligned to the visible From domain. The published policy expresses the domain owner’s preference; receivers decide delivery.
- All three together give you control over your sender reputation
Privacy
DNS queries send the domain and related names directly to Cloudflare, which also receives technical connection data.
Frequently asked questions
Do I really need all three — SPF, DKIM and DMARC?
For the Gmail/Yahoo 2024 bulk-sender rules: yes — and since May 2025 Microsoft applies similar requirements (SPF, DKIM, DMARC) to senders of 5,000+ emails/day to outlook.com. Even for smaller senders the combination is what makes your email trustworthy to modern providers. SPF alone is no longer enough — DKIM cryptographically signs your mails and DMARC tells receivers how to handle failures.
What does DMARC p=none vs p=quarantine vs p=reject mean?
DMARC p=none expresses no handling preference; p=quarantine treats failing mail as suspicious and p=reject requests rejection. Receiver filters still apply. With t=y, reject is reduced to quarantine and quarantine to none. Verify legitimate sending paths before tightening policy.
Why does DKIM fail even though I set it up?
Common causes: the DNS record hasn't fully propagated yet, the selector doesn't match the one your mail server signs with, or the key was truncated during DNS entry (DKIM public keys are long and easy to mis-paste). Double-check by fetching the TXT record with dig.
