SPF, DKIM & DMARC Checker
Check a domain's email records so your mails land in the inbox, not spam.
- Free
- No signup
- Exact records to copy
- Nothing stored
Sender rules and record values as of 9 November 2026
Check a domain
What we check
- MX records: who receives your mail
- SPF, following every include and counting DNS lookups (limit 10)
- DKIM keys at 35 common selectors, plus yours
- DMARC policy and reports, and BIMI
Public DNS records only. Nothing is sent to your domain and nothing is stored.
Email authentication
Enter your domain to see whether receivers can trust mail from it, and the exact records to fix.
- SPF lists the servers allowed to send as you.
- DKIM signs each message so it can't be altered.
- DMARC tells receivers what to do when both fail, and sends you reports.
Records for Google Workspace and Zoho Mail
Check your domain above and these are filled in for it. Add or replace them at your domain's DNS provider.
From your provider's help page or admin console. Zoho's differs by data centre.
A mailbox you check, or a DMARC report service.
DMARC stage
Start here: nothing changes for your mail, and you get daily reports. Stay two to four weeks.
@smtp.google.com
Priority 1. Delete MX records from any old provider.
@v=spf1 include:_spf.google.com ~all
Add this as a new TXT record. A domain may have only one SPF record.
DKIM: TXT at google._domainkey
Admin console > Apps > Google Workspace > Gmail > Authenticate email. Generate a 2048-bit record (1024 only if your DNS host can't take long records), add it as a TXT record at google._domainkey, wait for it to show up, then click Start authentication.
_dmarcv=DMARC1; p=none; rua=mailto:dmarc@yourdomain.in
Replace any existing record at _dmarc. A domain may have only one.
Workspace accounts set up before 2023 may use the older ASPMX MX records. Google says those still work; you don't need to change them.
How to use it
Type your domain, or any email address on it, like you@yourcompany.in.
We look up MX, SPF with every include, DKIM, DMARC and BIMI, and grade each one.
Copy the exact records from the fix list, or build them for Google Workspace or Zoho Mail.
What SPF, DKIM and DMARC do
SPF is a TXT record listing the servers allowed to send mail for your domain. DKIM signs every message with a key whose public half lives in your DNS at selector._domainkey. DMARC, at _dmarc, tells receivers what to do when a message fails both for the domain in its From address, and sends you daily reports. Without them, your invoices and quotes look like anyone else's, and spam filters treat them that way.
The rules this checker applies
| Check | Rule | Source |
|---|---|---|
| One SPF record | Two or more v=spf1 records fail every message | RFC 7208 |
| 10 DNS lookups | include, a, mx, ptr, exists and redirect each count, inside includes too | RFC 7208, 4.6.4 |
| 2 empty lookups | More than 2 lookups that find nothing fail SPF | RFC 7208, 4.6.4 |
| DKIM key length | 1024 bits minimum for Gmail, 2048 recommended | Gmail, RFC 8301 |
| DMARC | v=DMARC1 first; p is none, quarantine or reject | RFC 9989 (May 2026) |
A worked example
v=spf1 include:_spf.google.com include:zohomail.in include:servers.mcsv.net ~all uses 5 of the 10 lookups: one each for the Google and Mailchimp includes, and three for Zoho, whose own record includes two more. Add a CRM, a helpdesk and an invoicing tool and you can pass 10 without noticing. The checker follows every include and shows where the lookups go.
Gmail, Yahoo and Outlook.com rules
Every sender to Gmail needs SPF or DKIM, valid reverse DNS, TLS and a spam rate under 0.3%. Senders of more than 5,000 messages a day also need both SPF and DKIM, DMARC of at least p=none, a From domain aligned with SPF or DKIM, and one-click unsubscribe. Gmail and Yahoo have required this since February 2024, and since November 2025 Gmail rejects some mail that doesn't comply. Outlook.com has sent non-compliant bulk mail to Junk since 5 May 2025.
Records for Google Workspace and Zoho Mail
| Record | Google Workspace | Zoho Mail |
|---|---|---|
| MX | smtp.google.com, priority 1 | mx, mx2 and mx3.zoho.in at 10, 20 and 50 (.com or .eu for other data centres) |
| SPF | include:_spf.google.com ~all | include:zohomail.com on Zoho's help page; the Admin Console shows your data centre's value |
| DKIM | Selector google, made in Admin console, Gmail, Authenticate email | A selector you name, made in Admin Console, Domains, Email Configuration, DKIM |
| DMARC | Start with p=none and a rua address, then quarantine, then reject | |
Common mistakes
- A second SPF record added for a new service, which breaks both.
- Includes piling up past 10 lookups.
- DMARC left at p=none for years: it reports, but stops nothing.
- No DKIM on newsletter or CRM mail, so it fails DMARC once you enforce it.
- +all, which lets anyone send as you.
When it's worth getting help
If you send campaigns, invoices and follow-ups from several tools, getting every one signed and aligned is fiddly. Our digital marketing team sets up email that reaches the inbox and keeps it there. While you're checking, see whether AI assistants can read your site with the AI crawler checker, or run a website speed audit.
Sources
RFC 7208 (SPF), RFC 9989 (DMARC), RFC 8301 (DKIM keys), RFC 7505 (null MX), Google's sender guidelines and FAQ, Yahoo's sender best practices, Microsoft's Outlook.com requirements, Google Workspace help on SPF, DKIM, DMARC and MX, and Zoho Mail help on SPF, DKIM, MX and DMARC. All read on 9 November 2026.
FAQ
Questions
What's the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for your domain. DKIM adds a signature to each message that receivers check against a key in your DNS. DMARC tells receivers what to do when a message passes neither for your domain (deliver, send to spam or refuse) and sends you reports. You need all three: DMARC only works on top of SPF and DKIM.
Can a domain have two SPF records?
No. With two or more TXT records starting v=spf1, SPF fails for every message (RFC 7208 calls it a permerror). This usually happens when a new service tells you to "add an SPF record". Merge them into one record with every include, ending in a single ~all. The checker writes the merged record for you.
What does "too many DNS lookups" mean for SPF?
Each include, a, mx, ptr, exists and redirect in your record costs a DNS lookup, and so does each one inside the records you include. Receivers stop at 10 and fail SPF. Remove services you no longer use, replace a and mx with ip4 ranges, or send bulk mail from a subdomain with its own record.
Which DMARC policy should I use?
Start with p=none and a rua address, and read the reports for two to four weeks to make sure every service you send from passes. Then move to p=quarantine, which sends failures to spam, and later to p=reject. Gmail and Yahoo accept p=none for bulk senders, but only quarantine and reject stop people faking your domain.
Why can't the checker find my DKIM key?
DKIM keys sit at a selector name the sending service picks, and there's no way to list them. We try 35 common ones, such as google, selector1, zoho, k2 and s1. If yours is different, open an email you sent, view the original message, find s= in the DKIM-Signature line and enter that selector.
What do Gmail and Yahoo require from bulk senders?
If you send more than 5,000 messages a day to Gmail: SPF and DKIM, a DMARC record of at least p=none, a From address aligned with your SPF or DKIM domain, one-click unsubscribe in marketing mail and a spam rate under 0.3%. Yahoo asks the same and wants unsubscribes honoured within 2 days. Every sender needs SPF or DKIM.
Should my SPF record end in ~all or -all?
Google recommends ~all, and it's the safer choice. Once DMARC is at quarantine or reject, DMARC makes the decision anyway, while -all can make some receivers refuse forwarded mail on SPF alone. Never use +all: it lets anyone send as you. ?all, or no all at all, tells receivers nothing.
Digital marketing
Email campaigns that reach the inbox, set up and run for you.
Mind Over Matter builds it for Surat businesses and clients across India. Reply within 24 hours.
Free tools
More free tools
Website speed audit
Paste a URL and get real Core Web Vitals for mobile and desktop, with a prioritised fix list, in about 30 seconds.
Google review QR card
Turn your Google review link into a printable "Review us on Google" card with a QR code for your counter or bills.
AI crawler & llms.txt checker
Check whether ChatGPT, Claude, Perplexity and Google's AI crawlers are allowed on your site, and whether you have an llms.txt file.