SPF, DKIM and DMARC checker
Read all three of your domain's email authentication records in one go.
How SPF, DKIM and DMARC work together
In your SPF record, you list the servers that may send mail with your domain in the envelope sender. With DKIM, your mail service signs each message, and receiving servers check that nothing changed on the way. In your DMARC record, you set what happens to mail that fails both checks, and where reports go.
| Record | DNS location | How receivers use it | Failing on its own |
|---|---|---|---|
| SPF | example.com |
They check the sending server against your list | DMARC still passes if DKIM aligns, but receivers may reject early |
| DKIM | selector._domainkey |
They check the signature against your public key | DMARC still passes if SPF aligns, but forwarded mail can break |
| DMARC | _dmarc.example.com |
They act on failing mail as you set, and send you reports | Receivers use standard spam filtering and send no reports |
This lookup only shows what you published in DNS. Your DMARC reports show
which of your real senders pass, and we read them to decide when each step toward
p=reject is safe.
DMARC enforcement with automatic rollback
Get your domain to p=reject without blocking your own mail
We read your DMARC reports and email you each step once they show it's safe. You approve every step. When a sender you marked as yours sends enough mail to measure and a step starts blocking it, we put the previous policy back.
p=nonereports onlyp=quarantineyou approvep=rejectyou approve
Rollback needs hosted DMARC, on the Starter plan and up. You can try it free for 30 days with no card. Rollback works in the days after each step, and it can't bring back mail a receiver already refused. How rollback works
Create your account
Continue with Googleor
Free for your first domain · No card · Per-source totals kept for life
MSPs can group domains by client.
Questions
Do I need all three?
Yes. SPF and DKIM each fail in ordinary cases: forwarding breaks SPF, and a mailing list
that edits the subject or adds a footer breaks DKIM. DMARC passes when either one passes
for the domain in your From address, so with both, one failure does not sink a message.
DMARC tells receivers what to do with mail that fails both, and sends you the reports.
Gmail and Outlook.com require
all three from anyone sending them 5,000 or more messages a day, with DMARC at
p=none or stricter.
Does p=none stop spoofing?
No. At p=none, receivers handle failing mail as they would without DMARC
and send you aggregate reports. It is the safe first step: the reports show every
service that sends as you, so you can fix each one before you move to quarantine or
reject. Our DMARC setup guide covers the steps, and
the DMARC checker confirms each change.
Can I publish two SPF records?
No. Each domain gets one SPF record, and that one record lists every service that sends
for you, each as an include: or ip4: entry. If a receiver finds
two v=spf1 records on one name, it returns permerror and uses neither (RFC
7208). The record can list as many services as fit in 10 DNS lookups, as the next
question explains. Our SPF record
generator merges two records into one.
Why does email from my platform fail DMARC?
Many platforms send with their own domain as the envelope sender and sign with their own
d= domain. SPF and DKIM then pass for the platform's domain, but neither
lines up with the domain in your From address
(identifier alignment), so the message fails DMARC.
To fix it, set up domain authentication in the platform's settings: it gives you a few
DNS records to publish, and then it signs with your domain. Do this before you move to
p=reject, or receivers refuse that platform's mail.
How do I find my DKIM selector?
Leave the selector field blank and we try the common selector names. If none of them
answers, open a message you sent and find s= in its DKIM-Signature header;
our email header analyzer reads it for you.
Your sending platform's DKIM settings also show the selector. Then test it with our
DKIM checker.
Why did my SPF record hit the lookup limit?
SPF allows 10 DNS lookups for the whole check (RFC 7208). Each include:,
a, mx, ptr, exists and
redirect= costs one, and so does each of those inside the records you
include. ip4:, ip6: and all cost nothing. Large
providers nest includes, so three or four services can use all 10. Receivers read the
record left to right and stop at the first match (RFC 7208 section 4.6.2). A sender they
need an eleventh lookup to find gets permerror and fails SPF. Senders they find within ten
lookups still pass. Our
SPF 10-lookup limit guide shows how to bring
the count down.