About this tool
Email deliverability check, explained
Email authentication is how inbox providers tell your real email apart from someone pretending to be you. This checker reads a domain's MX, SPF, DMARC and DKIM records in public DNS, grades them, and writes the exact record to add or fix for each one.
How to use it
- 1Type your domain, or any address at it like you@acme.com, in the bar. If your email provider uses an unusual DKIM selector, enter it under Custom DKIM selector.
- 2Click Check my domain.
- 3Read the grade and the summary, which names the record to fix first, then each row: Good, Weak, Missing, Broken, Unsafe or Not found, with what was found.
- 4Add the suggested record under any row that needs work in your DNS settings, or use Copy all fixes or Download zone file, then run the check again.
How it works
What each check looks for
The check runs on a server and only makes DNS queries: it never connects to your mail servers. A leading www. is removed, a query that fails or takes more than 4 seconds counts as no record, and a subdomain without its own DMARC record inherits its parent domain's, as receivers do.
Mail servers (MX): passes when at least one MX record exists, lists up to six in priority order, and recognizes common providers such as Google, Microsoft 365, Zoho, Proton Mail and Fastmail. A domain with no MX, or a null MX, is treated as not receiving mail and left out of the grade.
SPF: the TXT record starting with v=spf1. The checker follows its include and redirect terms to count DNS lookups against the limit of 10. It is Good with -all, or with ~all when DMARC is set to quarantine or reject. It is Weak with ~all and no enforced DMARC, with no all at the end, at 9 or 10 lookups, or when it uses the deprecated ptr. It is Unsafe with +all or ?all, and Broken with more than 10 lookups, a loop, an unknown term or two SPF records.
DMARC: the TXT record at _dmarc starting with v=DMARC1. p=quarantine or p=reject is Good when it asks for reports (rua) and covers all mail, and Weak otherwise. p=none is Weak because it only monitors. A missing record, two records or an invalid policy fail.
DKIM: the checker looks for keys at 27 selectors common among email providers and sending tools, plus the one you type. A key of 2048 bits or more, or an Ed25519 key, is Good, a shorter key is Weak, an empty key is revoked, and no key at all shows Not found.
The grade averages the core rows that apply, counting a pass as 1 and a weak result as a half: A from 90, B from 80, C from 70, D from 60, F below. BIMI, MTA-STS and TLS-RPT are shown as extras with their own suggested records, outside the grade.
When to use it
Ways people use it
Before an email campaign
Make sure the sending domain has SPF, DKIM and an enforced DMARC policy before a large send goes out.
After changing email providers
Confirm the new provider is in your SPF record, its DKIM key is published and the old records are gone.
Protecting domains you do not send from
A domain with no mail servers and no senders is recognized as sending no mail, and the checker suggests a strict SPF record, a DMARC reject policy and a null MX to lock it.
Auditing client domains
Agencies and IT providers can check a client's domain in seconds and hand over the zone file of records to add.
FAQ
Questions people ask
What are SPF, DKIM and DMARC?
SPF lists the servers allowed to send email for your domain. DKIM adds a cryptographic signature to each message that receivers check against a key in your DNS. DMARC tells receivers what to do when a message fails those checks, and where to send reports.
Why are my emails going to spam?
Missing or weak authentication is a common cause, and the easiest to fix: publish SPF, DKIM and a DMARC policy. Sending reputation, list quality and content also play a part.
What does ~all mean in an SPF record?
It is a soft fail: mail from servers not listed in the record should be accepted but treated as suspicious. -all is a hard fail, asking receivers to reject that mail. ~all is fine when DMARC is set to quarantine or reject, since DMARC then decides what happens to spoofed mail.
What is the SPF 10 lookup limit?
Receivers stop evaluating an SPF record after 10 DNS lookups, counted across include, a, mx, ptr, exists and redirect terms, including those inside included records. Past the limit SPF fails for every message. Remove includes for services you no longer use, or replace them with ip4 and ip6 ranges.
Which DMARC policy should I use?
Start with p=none and a reporting address (rua) to see who sends email as your domain. Once every legitimate sender passes SPF or DKIM, move to p=quarantine, then p=reject, which tells receivers to refuse spoofed mail.