Sender Policy Framework
A TXT record on your domain listing the servers allowed to send mail for it, e.g. v=spf1 include:_spf.google.com ~all. A domain may have only one SPF record, and evaluating it may take no more than 10 DNS lookups.
Free tool · no sign-up
Free SPF, DKIM & DMARC checker
Gmail and Yahoo (since February 2024) and Microsoft Outlook (since May 2025) require bulk senders to authenticate their domain with SPF, DKIM and DMARC. Enter your domain to check all three — plus MX, BIMI, MTA-STS and TLS-RPT — and get a score, the bulk-sender verdict and a prioritized list of fixes.
Authentication report for
Score: / 100
Checked at
Result from the last 10 minutes. Just changed your DNS? Check again in a few minutes.
What to fix, by priority
Your domain is only half of deliverability — clean your list
Create free account — 200 credits Perfect authentication does not stop bounces. Sending to invalid, disposable or abandoned addresses hurts your sender reputation as much as a missing DMARC record. Validate your list before the next campaign.
→ Check a single address with the free e-mail validator → Block bad addresses at sign-up with real-time validation
How this SPF, DKIM and DMARC checker works
- 1
Live DNS lookups
We query your domain’s DNS in real time. Paste a domain, an e-mail address or a URL — we extract the domain for you.
- 2
SPF parsed and counted
We read your SPF record, follow every include and redirect, count the DNS lookups against the RFC 7208 limit of 10 and check the final “all” qualifier.
- 3
DKIM and DMARC
We probe 30+ common DKIM selectors plus up to 5 of yours, measure the key size and parse your DMARC policy, pct and reporting address.
- 4
Score and fixes
You get a 0–100 score with an A–F grade, the Gmail/Yahoo/Outlook bulk-sender verdict and a prioritized list of what to fix, in plain language.
SPF, DKIM, DMARC, BIMI and MTA-STS in plain words
A handful of DNS records decide whether mailbox providers trust mail that claims to come from your domain.
DomainKeys Identified Mail
Your sending platform signs every message with a private key; the public key is published at selector._domainkey.yourdomain. A valid signature proves the message was not altered and that your domain stands behind it. Use 2048-bit keys.
Domain-based Message Authentication, Reporting & Conformance
A TXT record at _dmarc.yourdomain telling receivers what to do with mail that fails aligned SPF and DKIM — p=none (monitor), p=quarantine (spam folder) or p=reject — and where to send reports (rua).
Optional extras
BIMI shows your brand logo next to your messages once DMARC is enforced (most big inboxes also require a mark certificate). MTA-STS and TLS-RPT make mail sent to your domain travel encrypted and tell you when it cannot.
→ Read the complete SPF, DKIM and DMARC guide, with a step-by-step rollout plan
Gmail, Yahoo and Outlook bulk-sender requirements
Since February 2024 Gmail and Yahoo — and since May 2025 Microsoft Outlook.com — apply stricter rules to anyone sending around 5,000 or more messages a day to their users. Mail that does not comply goes to spam or is rejected.
SPF and DKIM
Both must be set up for the sending domain. Smaller senders need at least one of them, but having both is the safe default.
DMARC, at least p=none
A valid DMARC record is mandatory. p=none is accepted, but only quarantine or reject actually stops spoofing of your domain.
Alignment
The domain in your visible From address must match the domain that passes SPF or DKIM. This is checked on real messages, not in DNS.
One-click unsubscribe
Gmail and Yahoo require marketing messages to carry a one-click List-Unsubscribe header (RFC 8058) and unsubscribes to be processed within two days.
Spam rate under 0.3%
Keep user-reported spam below 0.3% in Google Postmaster Tools — ideally under 0.1%. Old, invalid and abandoned addresses push bounces and complaints up.
Valid PTR and TLS
Sending IPs need matching forward and reverse DNS, and messages should be delivered over a TLS connection.
This checker verifies everything that is visible in DNS. Alignment, unsubscribe headers and spam rate depend on how you send — and on the quality of your list.
Frequently asked questions
Is this SPF, DKIM and DMARC checker free?
Yes. You can run 30 checks a day without an account. The tool only reads public DNS records — no e-mail is sent from or to your domain.
What is a good DMARC policy?
Start with p=none and a rua address to collect reports for a few weeks. Once every legitimate sender passes aligned SPF or DKIM, move to p=quarantine and then p=reject, applied to 100% of messages. p=none meets the Gmail, Yahoo and Outlook baseline but does not protect your domain from spoofing.
Why does SPF have a limit of 10 DNS lookups?
RFC 7208 caps the mechanisms that trigger DNS queries (include, a, mx, ptr, exists and redirect) at 10 per check, to protect receivers. Above that the result is “permerror” and many receivers treat SPF as failed. Remove services you no longer use, replace includes with ip4/ip6 ranges where they are stable, or move some senders to subdomains.
What is a DKIM selector and how do I find mine?
The selector is the label under which a DKIM public key is published (selector._domainkey.yourdomain), so one domain can have several keys. Open a message you sent, view the original headers and look for DKIM-Signature: the s= value is the selector and d= is the signing domain.
Should my DKIM key be 1024 or 2048 bits?
Use 2048 bits. 1024-bit keys are still accepted by the big providers but are considered weak, and keys shorter than 1024 bits are rejected. If your DNS host cannot store the long value in one string, split it into several quoted strings inside the same TXT record.
Do I need BIMI?
No. BIMI is optional and does not improve deliverability by itself. It shows your logo in supporting inboxes once DMARC is at quarantine or reject; Gmail and Apple Mail also require a Verified Mark Certificate (Gmail accepts a Common Mark Certificate too).
Why can’t the checker find my DKIM key?
DKIM keys can only be found by knowing the selector — DNS has no way to list them. We try 30+ common selectors; if your platform uses a custom one, enter it in the optional field. Also confirm that your platform signs with your own domain (d=yourdomain), not with its own.
How long do DNS changes take to show up?
Usually minutes, but it can take as long as the record’s TTL (often one hour, sometimes up to 48 hours). Our results are cached for 10 minutes, so wait a little before checking again.
Authenticated domain + clean list = inbox
A free account gives you 200 credits (10 for free-provider e-mails) to validate lists in bulk, through the REST API or in real time on your forms.
Create free account — 200 creditsNo credit card. Credits never expire.