What the checks mean
- SPF lists the servers allowed to send mail for your domain. Receivers check the sending server against it.
- DKIM signs each message with a key published in DNS. Your mail provider gives you the selector name.
- DMARC tells receivers what to do when SPF or DKIM fail, and where to send reports.
- MX shows which servers receive mail for the domain.
Results come from public DNS records at the moment you check. DNS changes can take a few hours to spread, so check again after you edit a record.
How to fix the common problems
- No SPF record. Add a TXT record at the domain that starts with v=spf1, lists your sending services, and ends with -all or ~all.
- SPF lookup limit exceeded. Each include: and a/mx entry costs one lookup. Remove services you no longer use, or flatten the record with your provider's help.
- +all in SPF. Replace +all with -all or ~all. +all lets anyone send as your domain.
- No DMARC record. Add a TXT record at _dmarc with v=DMARC1; p=none; rua=mailto:you@yourdomain. Start with p=none to collect reports.
- DMARC stuck on none. Read the reports for a few weeks, fix any legitimate senders that fail, then move to p=quarantine and later p=reject.
- No DKIM key found. Turn on DKIM in your mail provider's settings, publish the record it gives you, then enter the selector above.
// questions/
Questions.
What is an email authentication check?
It reads the DNS records that tell receiving mail servers whether a message really came from your domain. The three main records are SPF, DKIM and DMARC. Together they reduce spam and stop criminals sending fake mail in your name.
Why does DKIM show "no key found"?
DKIM keys are published under a selector name chosen by your mail provider, such as google or selector1, so the tool can only check the common names. Enter your selector in the box to check it directly.
What is a good DMARC policy?
Start with p=none to watch reports, move to p=quarantine when the reports look clean, and finish at p=reject. Adding a rua address lets you receive those reports.
Why does SPF have a 10-lookup limit?
Each include, a, mx, ptr, exists and redirect entry can trigger more DNS lookups. Receivers stop after 10 and treat SPF as failed, so a long record can break mail even when every service is listed.
Is my domain stored?
No. The tool looks up the public DNS records for the domain you enter, and nothing is saved on our servers. The result is cached for a few minutes only to speed up repeat checks.
Does a pass mean my email will reach the inbox?
Not always. Authentication is one signal among many. Good sending habits, clean lists and engaged recipients also matter. A pass means the basics are in place.
Can I check a domain I do not own?
Yes, it is public DNS data. Use the tool to review your own domains, or to check a sender you receive mail from.
Your privacy
The lookup runs through our server only to read public DNS records. We do not store the domains you check. Read the website privacy policy for details.