Skip to content

Email Checker

SPF, DKIM, DMARC and MX for a domain, read and explained, including the SPF lookup budget most tools never count.

Selectors cannot be discovered. Leave this empty to try the common ones, or name yours to be sure.

About SPF, DKIM and DMARC

Three records decide whether your mail is believed. SPF lists who may send for your domain, DKIM signs each message with a key published in DNS, and DMARC tells receivers what to do when neither matches. A missing or broken one of them does not bounce your mail loudly: it lands in spam, quietly, and usually for the recipients you care about most.

The number to look at first is the SPF lookup budget. SPF allows ten terms that query DNS, and they are counted through every include, so a record with two words in it can consume a dozen once your provider's own includes are followed. Over the limit, the whole evaluation is a permanent error and receivers behave as though you had published nothing. It is the failure that appears without anyone changing anything on your side, the day a provider adds an include to their record. The second thing to read is the DMARC policy: p=none monitors and protects nothing, and it is where most domains stop. As for DKIM, a selector cannot be discovered, so a tool finding no key proves only that it guessed wrong. Name your selector to get a real answer.

Frequently asked questions

My SPF record is short. How can it be over ten lookups?
Because the limit counts through includes. Your record may contain three includes, but each of those is another record with includes of its own. Large providers routinely cost four to six lookups each. The breakdown above shows what each one actually costs.
Is p=none enough?
It is a legitimate first step: it collects reports without affecting delivery. But it protects nothing. Anyone can send mail claiming to be your domain and receivers will do exactly as much about it as before. The point of p=none is to be temporary.
The tool found no DKIM key. Do I have a problem?
Probably not. DKIM selectors are arbitrary names and cannot be listed, so we try the common ones and report honestly when none of them hits. Enter your own selector, which your email provider shows you, and you will get a real answer.
Why does a 1024-bit key get flagged?
RFC 8301 raised the recommendation to 2048 bits in 2018, and several large receivers now weight a 1024-bit signature lower. It still works, so it is a warning and not an error, but it is worth rotating the next time you touch the record.

Related guides

Related tools

Go further

Network glossary: Reverse DNS, TTL

Run a visual traceroute to this host