Skip to content

Email Checker

SPF, DKIM, DMARC and MX for a domain, read and explained, including the SPF lookup budget most tools never count.

Selectors cannot be discovered. Leave this empty to try the common ones, or name yours to be sure.

About SPF, DKIM and DMARC

Three records decide whether your mail is believed. SPF lists who may send for your domain, DKIM signs each message with a key published in DNS, and DMARC tells receivers what to do when neither matches. A missing or broken one of them does not bounce your mail loudly: it lands in spam, quietly, and usually for the recipients you care about most.

What the receiving server checksSPF and DKIM each vouch for a domain. DMARC asks whether that domain is the one in the From address the reader sees.
  1. The message leaves your server
    Sending servermail.example.com 198.51.100.25
    DKIM signature: domain and selectord=example.com; s=selector1
    Envelope sender (MAIL FROM), hidden from the readerbounce@example.com
    From address, shown to the readernews@example.com
  2. The receiving server checks
    1. SPF

      Is the sending address listed in the SPF record of the envelope sender's domain?

      TXT example.comv=spf1 ip4:198.51.100.25 -all
    2. DKIM

      Does the signature verify with the public key the signing domain (d=) publishes under its selector?

      TXT selector1._domainkey.example.comv=DKIM1; p=MIIBIjANBg…
    3. DMARC

      Did SPF or DKIM pass for a domain aligned with the From? One aligned pass is enough; without one, the domain's policy applies.

      TXT _dmarc.example.comv=DMARC1; p=quarantine

      Aligned means the same domain as the From or, in the default relaxed mode, the same parent domain: mail.example.com aligns with example.com. A pass for any other domain, a provider's for instance, does not count.

  3. What happens next
    • DMARC passesThe message goes on to the usual spam filters, then to the inbox.
    • Fails, p=noneDelivered as if there were no DMARC: the failure only shows in the reports, if you ask for them (rua).
    • Fails, p=quarantineSent to the spam folder.
    • Fails, p=rejectRefused during delivery: the sender gets a bounce.
the e-mail check of github.com: MX, SPF with its budget of 10 DNS lookups, DKIM keys and DMARC policy, and what needs attention.

The number to look at first is the SPF lookup budget. SPF allows ten terms that query DNS, and they are counted through every include, so a record with two words in it can consume a dozen once your provider's own includes are followed. Over the limit, the whole evaluation is a permanent error and receivers behave as though you had published nothing. It is the failure that appears without anyone changing anything on your side, the day a provider adds an include to their record. The second thing to read is the DMARC policy: p=none monitors and protects nothing, and it is where most domains stop. As for DKIM, a selector cannot be discovered, so a tool finding no key proves only that it guessed wrong. Name your selector to get a real answer.

Frequently asked questions

My SPF record is short. How can it be over ten lookups?
Because the limit counts through includes. Your record may contain three includes, but each of those is another record with includes of its own. Large providers routinely cost four to six lookups each. The breakdown above shows what each one actually costs.
Is p=none enough?
It is a legitimate first step: it collects reports without affecting delivery. But it protects nothing. Anyone can send mail claiming to be your domain and receivers will do exactly as much about it as before. The point of p=none is to be temporary.
The tool found no DKIM key. Do I have a problem?
Probably not. DKIM selectors are arbitrary names and cannot be listed, so we try the common ones and report honestly when none of them hits. Enter your own selector, which your email provider shows you, and you will get a real answer.
Why does a 1024-bit key get flagged?
RFC 8301 raised the recommendation to 2048 bits in 2018, and several large receivers now weight a 1024-bit signature lower. It still works, so it is a warning and not an error, but it is worth rotating the next time you touch the record.

Related guides

Related tools

Go further

Network glossary: Reverse DNS, TTL

Run a visual traceroute to this host