MX, SPF & DMARC Checker
Check a domain's MX, SPF, DKIM and DMARC setup. Free, no sign-up
A DKIM key can only be found by its selector. Leave it empty and the common ones are tried.
How to read the answer
MX records name the servers that receive mail for the domain, the lowest preference number first. With none, senders try the domain's own address instead. A single MX of "0 ." is a null MX: the domain saying it takes no mail at all.
SPF is one TXT record that starts with v=spf1 and lists the servers allowed to send the domain's mail. A domain may have only one. Receivers stop after ten DNS lookups while reading it, counting every include, a, mx, ptr, exists and redirect, those of the records it includes too, so a record that costs more is treated as broken.
DKIM signs each message with a key whose public half is published in the DNS. The key sits under a name chosen by whoever signs the mail (the selector), and nothing in the DNS lists the selectors, so a DKIM key can only be found when its selector is known. Your mail provider tells you yours; it is also in the DKIM-Signature header of a message you sent, as s=.
DMARC, at _dmarc and the domain, tells receivers what to do with mail that fails both SPF and DKIM for your domain: nothing (none), put it in spam (quarantine) or refuse it (reject), and where to send reports about it.
Questions about this tool
What do I need for my email to be trusted?
A working MX record so you can receive mail, one SPF record listing every service that sends as your domain, DKIM signing turned on at your mail provider, and a DMARC record. Big receivers such as Gmail and Yahoo expect all of these from anybody who sends a lot of mail. They help your mail be believed; they do not guarantee the inbox.
Why does it say my SPF record has too many lookups?
Receivers stop after ten DNS lookups while reading an SPF record, counting the lookups of every record it includes. Past ten, the record is a permanent error and is treated as if it were not there. Remove services you no longer use, or replace an include with the addresses it stands for.
Why was no DKIM key found?
A DKIM key can only be looked up by its selector, a name your mail provider chooses. Without one, this tool tries the selectors most providers use; finding none of them does not mean you have no DKIM. Type your selector to check it: it is the s= value in the DKIM-Signature header of a message you sent.
Should my DMARC policy be none, quarantine or reject?
Start with none and an address for reports, so nothing changes while you learn who sends mail as your domain. Once every real sender passes, move to quarantine and then reject, which is what protects your domain from being forged.
Does a pass here mean my mail will not go to spam?
No. These records let receivers check that mail really comes from you. Whether it lands in the inbox also depends on what you send, how many people mark it as spam and the reputation of the servers that send it, which only each receiver knows.