How do I use the SPF, DKIM and DMARC checker?
- Enter your email domain, for example yourcompany.ae.
- Add your DKIM selector if you know it.
- Press Check email setup and apply the fixes listed.
Why does email authentication matter in 2026?
Mailbox providers now expect every sender to prove it is allowed to send for its domain. Without SPF, DKIM and DMARC, your quotes, invoices and replies are more likely to land in spam, and criminals can send email that appears to come from your domain to trick your customers and suppliers. Gmail and Yahoo require authentication for bulk senders, and Microsoft has tightened its rules for high-volume senders too.
How do SPF, DKIM and DMARC work together?
| Record | Question it answers | Where it lives | |
|---|---|---|
| SPF | Is this server allowed to send for the domain? | One TXT record at the root | |
| DKIM | Was this message signed by the domain and unchanged? | TXT at selector._domainkey | |
| DMARC | What should receivers do if checks fail, and where should reports go? | TXT at _dmarc | |
DMARC passes when SPF or DKIM passes and matches the domain in the From address. That alignment is what stops spoofing.
What is a safe path to DMARC enforcement?
- Publish SPF listing every service that sends for you: your mailbox provider, website forms, CRM, newsletters and invoicing.
- Turn on DKIM signing in each of those services.
- Publish DMARC with p=none and a reporting address.
- Read the reports for two to four weeks and fix any legitimate sender that fails.
- Move to p=quarantine, then p=reject.
We set this up as part of our domains and email service and monitor the reports afterwards.
SPF, DKIM and DMARC checker: frequently asked questions
Why do my emails go to spam?
The most common cause is missing or wrong SPF, DKIM or DMARC records. Gmail and Outlook now require them from bulk senders.
Where do I find my DKIM selector?
In your email provider’s DKIM settings. Google Workspace uses "google" and Microsoft 365 uses "selector1" and "selector2".
What are SPF, DKIM and DMARC?
SPF lists servers allowed to send your email, DKIM signs messages, and DMARC tells receivers what to do when checks fail and sends you reports.
Do Google and Yahoo require DMARC?
Bulk senders to Gmail and Yahoo must authenticate with SPF and DKIM and publish DMARC. Every business should.
What DMARC policy should I start with?
Start with p=none to collect reports, fix every legitimate sender, then move to quarantine and reject.
Can I have more than one SPF record?
No. Multiple SPF records make SPF fail. Merge them into one.
What is the SPF 10-lookup limit?
SPF may trigger at most 10 DNS lookups. Too many include: entries break it.
Why does the checker not show DKIM?
DKIM keys live under a selector name your provider chooses. Enter the selector, such as google or selector1.
Does this help stop spoofing?
Yes. DMARC at quarantine or reject stops others sending email that pretends to come from your domain.
Why do results differ from another checker?
DNS and web responses are cached for their TTL and may differ by location. Our checks use Cloudflare’s 1.1.1.1 resolver.
Learn more
- GuideHow to move a website to a new host without downtime
- GuideWhy your business emails go to spam (and how to fix it)
- GlossaryWhat is MX record?A DNS record that tells the world where to deliver your email.
- GlossaryWhat is SPF?A DNS record listing the servers allowed to send email for your domain.
- GlossaryWhat is DKIM?A digital signature that proves an email was not altered.