DMARC checker: test SPF, DKIM and MX so your email reaches the inbox
A DMARC checker that also reads the SPF, DKIM and MX records of your domain and gives you the exact records to add when something is missing.
- Free, no account
- Results in about 5 seconds
- Any domain, whoever hosts your email
example-shop.hr
Google WorkspaceSample shop · the same check you get for your own domain
3 problems can send mail from example-shop.hr to spam or let others send as you. 4 optional records would add protection.
Your records
| Record | What DNS answered | Status |
|---|---|---|
| MX | 1 aspmx.l.google.com 5 alt1.aspmx.l.google.com | OK |
| SPF | v=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net include:spf.shop-host.example include:spf.crm.example include:spf.helpdesk.example a mx ~all 12 of 10 DNS lookups, the most expensive first: · include:_spf.google.com: 4 · include:spf.shop-host.example: 2 · include:servers.mcsv.net: 1 · include:sendgrid.net: 1 · include:spf.crm.example: 1 · include:spf.helpdesk.example: 1 · a: 1 · mx: 1 | Broken |
| DMARC | v=DMARC1; p=none | Fix |
| DKIM | selector "google" | OK |
| MTA-STS | none | Not set |
| TLS-RPT | none | Not set |
| BIMI | none | Not set |
| DNSSEC | not signed | Fix |
| Mail server IPs | run by your mail provider, which manages their reputation | Not needed |
What we found
Show 5 passed checks
Records to add
Paste these at your DNS provider, written for Google Workspace. Changes usually show within an hour; check again after that.
DMARC, next step: quarantine
TXT record- Name
- _dmarc.example-shop.hr
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example-shop.hr
Publish it once your reports show all real mail passing SPF or DKIM. Forged mail then goes to spam; move to p=reject after a few quiet weeks.
MTA-STS record
TXT record- Name
- _mta-sts.example-shop.hr
v=STSv1; id=2026092501
Change the id whenever the policy file changes.
MTA-STS policy file
File- URL
- https://mta-sts.example-shop.hr/.well-known/mta-sts.txt
version: STSv1 mode: testing mx: aspmx.l.google.com mx: alt1.aspmx.l.google.com max_age: 86400
Serve it over HTTPS with a valid certificate on the mta-sts subdomain. Switch mode to enforce and max_age to 604800 after a few clean TLS reports.
TLS-RPT record
TXT record- Name
- _smtp._tls.example-shop.hr
v=TLSRPTv1; rua=mailto:tls-reports@example-shop.hr
Receivers send a daily report when they could not deliver to you over TLS.
Fix these first
From the example above. Check your own domain to get the fixes that apply to it.
Problem: The SPF record has 1 problem
A broken SPF record counts as no record at all.
How to fix it: Remove include: entries for services you no longer use, and merge or flatten the rest until the count is 10 or less.Warning: DMARC only monitors (p=none), so spoofed mail still gets through
p=none only collects reports; receivers still deliver mail that fails.
How to fix it: Read the DMARC reports until every real sender passes, then set p=quarantine, and p=reject a few weeks later.Warning: DNSSEC is not enabled for the domain
DNSSEC signs your DNS records so resolvers can reject forged answers, the attack behind hijacked websites and intercepted mail.
How to fix it: Turn on DNSSEC at your DNS host (Cloudflare, most registrars and hosts have a switch) and, if the registrar is separate, add the DS record it gives you there.
What the DMARC checker tests
Fourteen checks on the DNS records and mail server reputation Gmail, Outlook and Yahoo look at before deciding where your email goes.
Mail servers (MX)
Checks the DNS records that tell other servers where to deliver email for your domain.
SPF record
Checks for the DNS record that lists which servers may send email for your domain.
SPF syntax and lookup limit
Checks the SPF record parses and stays within the 10 DNS lookups receivers allow.
SPF catch-all rule
Checks the end of the SPF record tells receivers what to do with mail from any other server.
DMARC record
Checks for the DNS record that tells receivers what to do when mail fails SPF and DKIM.
DMARC policy
Checks whether DMARC tells receivers to quarantine or reject mail that fails, or only to watch.
DMARC reports
Checks DMARC names an address for the daily reports that show who sends mail as your domain.
DKIM key
Looks for the public key receivers use to check that mail from your domain was not altered.
MTA-STS
Checks for the policy that makes other servers use encrypted connections when they deliver mail to you.
TLS reporting (TLS-RPT)
Checks for the record that asks senders to report failed encrypted deliveries to you.
BIMI logo
Checks for the record that lets Gmail, Yahoo and Apple Mail show your logo next to your messages.
DNSSEC
Checks your DNS answers are signed, so nobody can forge where your domain or mail points.
Show 8 more checks
DMARC record
Checks for the DNS record that tells receivers what to do when mail fails SPF and DKIM.
DMARC policy
Checks whether DMARC tells receivers to quarantine or reject mail that fails, or only to watch.
DMARC reports
Checks DMARC names an address for the daily reports that show who sends mail as your domain.
DKIM key
Looks for the public key receivers use to check that mail from your domain was not altered.
MTA-STS
Checks for the policy that makes other servers use encrypted connections when they deliver mail to you.
TLS reporting (TLS-RPT)
Checks for the record that asks senders to report failed encrypted deliveries to you.
BIMI logo
Checks for the record that lets Gmail, Yahoo and Apple Mail show your logo next to your messages.
DNSSEC
Checks your DNS answers are signed, so nobody can forge where your domain or mail points.
How the DMARC and DKIM checker works
Read your DNS
We look up your MX, SPF, DMARC, MTA-STS, TLS-RPT and BIMI records and try 27 DKIM selectors the big email providers use. For mail servers you run yourself, we also check their IPs against an email blacklist and test their reverse DNS.
Follow every include
Each SPF include is followed to the end, so lookups over the limit of 10, loops and broken includes show up before receivers reject your mail.
Write the fix
Every problem comes with the record to publish, ready to paste into your DNS provider. When we recognise your email provider from its MX records, the record is written for it.
We can only find DKIM keys under common selector names. If your provider uses a custom selector, the check says "not found" even when DKIM works; the headers of a sent email show the real selector.
DMARC, SPF and DKIM questions
What is DMARC, and how does it work?
DMARC is a DNS record that tells receiving mail servers what to do with email that claims to come from your domain but fails SPF and DKIM: deliver it (p=none), send it to spam (p=quarantine) or reject it (p=reject). It also asks receivers to send you reports. It only passes when SPF or DKIM passes for your own domain, which is what stops forged mail.
How do I check my DMARC record?
Enter your domain above: the checker reads the TXT record at _dmarc.yourdomain.com, checks its syntax, and shows whether the policy is none, quarantine or reject (and what receivers apply when test mode, t=y, is on) and where reports go. SPF, DKIM, MX, MTA-STS, TLS-RPT and BIMI are checked in the same run. From a terminal, dig TXT _dmarc.example.com shows the raw record.
What are Gmail's and Yahoo's sender requirements?
Since February 2024, everyone sending to Gmail or Yahoo needs SPF or DKIM, valid reverse DNS and a spam rate under 0.3 %. Bulk senders, 5,000 or more messages a day, also need both SPF and DKIM, a DMARC record of at least p=none with an aligned From domain, and one-click unsubscribe. Outlook applies similar bulk rules since May 2025. The checker shows which DNS parts you meet.
Why does SPF fail with too many DNS lookups?
SPF allows at most 10 DNS lookups while a record is checked, counting every include, a, mx, exists and redirect, including those nested inside includes. Each service you add, such as Google Workspace, a newsletter tool or a helpdesk, brings its own, so records pass the limit quickly and receivers return permerror. The checker follows every include and counts them for you.
How do I set up DMARC?
Add a TXT record at _dmarc.yourdomain.com, starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com. That only collects reports. Once they show that all your real mail passes SPF or DKIM, move to p=quarantine and then p=reject, so forged mail stops reaching inboxes. When a record is missing, the check writes one for you to paste into your DNS provider.
How do I set up DKIM?
Switch DKIM on in your email provider, such as Google Workspace or Microsoft 365, or in each service that sends mail for you, like your newsletter tool. Each gives you a record, usually a TXT or CNAME under a selector name, to add at your DNS provider. Then turn signing on in the provider and run this check again.
Can I have more than one SPF record?
No. A domain may have only one SPF record; with two, receivers treat SPF as broken. Merge them into one: keep a single v=spf1 at the start, list every include and ip4 from both, and end with one all, such as ~all. Keep the total under 10 DNS lookups by removing services you no longer use or replacing includes with their ip4 ranges.
Why does the check say DKIM was not found when it works?
DNS has no list of DKIM keys, so we can only try common selector names, 27 of them. If your provider uses a custom selector, the check says "not found" even when DKIM works. Open the headers of an email you sent: the s= value in the DKIM-Signature line is your selector, and the receiving server shows dkim=pass.
Does the checker tell me if my mail server is blacklisted?
Yes, for mail servers you run yourself: the IPs of your own MX hosts and single addresses in your SPF record are checked against the SpamCop blacklist, and their reverse DNS is tested. Mail hosted by Google Workspace, Microsoft 365 and similar providers is skipped, because their servers and their reputation are managed by the provider, not by you.
Related free tools
All 59 tools →Free, funded by the people who use it
No account, no paid plan. Donations keep it running.