Free SPF, DKIM and DMARC Checker
Not sure if your email authentication records are set up correctly? Enter your domain above and this tool will instantly check your SPF, DKIM and DMARC records — and explain in plain English what each one means and whether anything needs fixing.
Why email authentication matters
SPF, DKIM and DMARC are the three DNS records that tell the world your emails are legitimate. Without them, your emails are more likely to land in spam, and your domain is vulnerable to spoofing — where someone sends emails pretending to be you.
Getting all three set up correctly is one of the most important things you can do for email deliverability.
What each record does
SPF (Sender Policy Framework) specifies which mail servers are allowed to send email on behalf of your domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your emails, proving they haven't been tampered with in transit. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells receiving servers what to do if an email fails those checks — let it through, send it to spam, or reject it outright.
What to do if something is missing
If this checker flags a missing or misconfigured record, you'll need to add or update a DNS record with your domain registrar or hosting provider. Not sure where to start? Get in touch and I can take a look.
What is an SPF record and do I need one?
An SPF record is a DNS record that lists the mail servers authorised to send email from your domain. Without one, receiving servers have no way to verify your emails are genuine, making them more likely to be marked as spam or rejected. If you send any email from your domain, you need an SPF record.
What is DMARC and why does it matter?
DMARC is a DNS record that builds on SPF and DKIM. It tells receiving mail servers what to do when an email fails authentication checks — either let it through, quarantine it, or reject it. It also enables reporting, so you can see who is sending email using your domain. Without DMARC, even a perfect SPF and DKIM setup offers incomplete protection.
What is a DKIM selector?
A DKIM selector is a label that identifies which DKIM key was used to sign an email. Your email provider assigns it — common ones include "google", "k1", and "selector1". This checker automatically tries the most common selectors, but if none are found it will ask you to enter yours manually.
My records look fine here but my emails are still going to spam — why?
Authentication records are just one piece of the deliverability puzzle. Spam filtering also looks at your sending reputation, email content, engagement rates, and list quality. If your authentication is in order but you're still landing in spam, the issue is likely elsewhere. Get in touch and I can help diagnose it.
Does this tool work for Google Workspace and Microsoft 365?
Yes. It works for any domain regardless of which email platform you use. Google Workspace, Microsoft 365, and any other provider all use the same underlying DNS records.