DMARC and SPF checker
Check your domain's SPF, DMARC and DKIM records for free. See what each record does, what is missing and how to fix it, in plain English.
Free, no sign-up. Reads public DNS records only; nothing is sent or changed.
What are SPF, DKIM and DMARC?
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email for it, for example your email provider and your newsletter tool.
DKIM (DomainKeys Identified Mail) adds a signature to each message. Receivers fetch your public key from DNS (at selector._domainkey.yourdomain) to check that the message was signed by your domain and wasn't changed.
DMARC is a TXT record at _dmarc.yourdomain. It tells receivers what to do when a message fails SPF and DKIM alignment, and where to send reports about mail using your domain.
How to read your DMARC policy
- p=none: monitoring only. Receivers don't act on failures, but you get reports (if you set
rua=). - p=quarantine: failing mail is treated as suspicious, usually sent to spam.
- p=reject: failing mail is refused.
A common path is to start with p=none and a report address, check the reports until every service that sends for you passes, then move to quarantine and reject.
Common SPF mistakes
- Too many DNS lookups. Each include, a, mx, ptr and exists costs a lookup, and SPF allows at most 10. Over that, the check can fail.
- Two SPF records. A domain must have one. Two records count as an error, so merge them.
- +all or ?all. +all lets anyone pass; ?all says nothing. Use ~all while you test and -all when you're sure.
- ptr. Deprecated and slow; use ip4/ip6 or include instead.
How to add or fix the records
Records are added where your domain's DNS is hosted (your registrar, Cloudflare, or your web host's control panel), not in your email app.
- Google Workspace: SPF include
_spf.google.com; turn on DKIM in the Admin console (Apps › Google Workspace › Gmail › Authenticate email). Google's guide. - Microsoft 365: SPF include
spf.protection.outlook.com; DKIM is turned on in the Microsoft Defender portal. Microsoft's guide. - cPanel hosts (many shared hosts, including common Malaysian ones): Email › Email Deliverability shows and repairs SPF and DKIM for each domain. cPanel's guide.
Check the rest of your site's security
Email records are one part of it. The free Safe Scan also checks security headers, TLS, cookies and exposed common files, passively. For an active test of a domain you own, the Deep / Active Scan costs US$45 one-off. See how it works and a sample report, or check your security headers next.
FAQ
What does a DMARC checker do?
It reads your domain's public DMARC DNS record and tells you which policy it sets and whether the record is valid.
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send for your domain, DKIM signs messages, and DMARC tells receivers what to do when those checks fail and where to send reports.
Why does my DMARC check fail?
Common causes are no record at _dmarc, a syntax error, or mail sent by a service that isn't covered by SPF/DKIM alignment.
Is p=none enough?
It's a monitoring mode: receivers don't act on failures. Many domains start there and move to quarantine or reject once the reports look clean.
Why can't you find my DKIM key?
DKIM keys live under selectors that can't be listed. We try common ones. Check your email provider for yours.
Does this tool send email or change anything?
No. It only reads public DNS records.
Is it free?
Yes, the checker is free and needs no sign-up.