SPF, DKIM, DMARC and MX Checker
Type a domain and this checker asks public DNS for its mail records: where mail is delivered (MX), who may send it (SPF), the signing key (DKIM) and the policy for failures (DMARC). Each result comes with a plain verdict and, where something is missing, the record to paste for Google Workspace or Microsoft 365.
| Record | Type and name | What it answers |
|---|---|---|
| MX | MX at the domain itself | Which servers receive mail for the domain |
| SPF | TXT at the domain, starting v=spf1 | Which servers may send as the domain |
| DKIM | TXT or CNAME at selector._domainkey | The public key that checks message signatures |
| DMARC | TXT at _dmarc, starting v=DMARC1 | What receivers do when checks fail, and where to report |
Updated
Your browser sends each question straight to Google Public DNS, falling back to Cloudflare's resolver, over HTTPS. Nothing goes through our servers. DNS can only show what is published, so this tool cannot tell you whether a given message will land in the inbox; it tells you whether the setup that inbox providers look for is in place.
Check a domain
Lookups go from your browser to Google Public DNS, or Cloudflare if that fails. Nothing passes through We.Inc.
Starting records for Google Workspace
Values from Google's admin help. Replace example.com with your domain. The DKIM value is unique to you and comes from the Admin console.
Google Workspace DNS records
One MX record at priority 1, SPF with the Google include, the DKIM key at google._domainkey and a monitoring DMARC policy.
example.com. MX 1 smtp.google.com.
example.com. TXT "v=spf1 include:_spf.google.com ~all"
google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=<key from Admin console>"
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Starting records for Microsoft 365
Values from Microsoft Learn. The MX target and the two DKIM targets are generated for your tenant; copy them from the admin center.
Microsoft 365 DNS records
Microsoft recommends -all in SPF because it also recommends DKIM and DMARC. DKIM uses two CNAMEs so keys can rotate.
example.com. MX 0 <value from admin center>
example.com. TXT "v=spf1 include:spf.protection.outlook.com -all"
selector1._domainkey.example.com. CNAME <Selector1CNAME value>
selector2._domainkey.example.com. CNAME <Selector2CNAME value>
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"What counts toward the SPF limit of 10
| Term | Costs a lookup? | Note |
|---|---|---|
| include: | Yes | Plus everything inside the included record |
| a, mx | Yes | mx also resolves each mail server name |
| exists:, ptr | Yes | ptr is discouraged by the RFC |
| redirect= | Yes | Replaces the record with another domain's |
| ip4:, ip6: | No | Plain addresses and ranges |
| all | No | The catch-all at the end |
How the lookup counter works
The checker reads your SPF record, then fetches every include and redirect target and reads those records in turn, adding up the terms that cost a DNS query. It stops after 30 fetched records so a looping chain cannot run forever.
Plain ip4 and ip6 ranges and the final all term are free, which is why replacing a vendor include with that vendor's published address ranges is one way to get under the limit.
Reading DMARC results
The p= tag is the policy: none only collects reports, quarantine asks receivers to treat failures as suspicious, and reject asks them to refuse failures. The rua= tag is where daily summary reports are sent.
Subdomains you have not set up follow the parent domain's DMARC policy unless an sp= tag says otherwise.
How it works
- Enter the domain after the @ in your email address, for example yourcompany.com.
- Add a DKIM selector if you know it. The tool also tries the selectors Google Workspace and Microsoft 365 use by default, plus a few other common names.
- Read the verdict for each record. Green means published and well formed, amber means it works but could be stricter, red means missing or broken.
- Pick your mail provider to see the exact records to add or change, then paste them at your domain's DNS host.
Tips
- Keep exactly one SPF record per name. A second v=spf1 record makes receivers return a permanent error for both.
- When you add a new sending service, merge its include into the existing SPF record instead of creating another one.
- Start DMARC at p=none with a report address, read the reports for a few weeks, then move to quarantine and finally reject.
- DNS changes can take time to spread, so recheck after an hour before deciding a fix did not work.
Frequently asked questions
Why does my SPF record fail with too many lookups?
RFC 7208 caps the mechanisms that need extra DNS queries at 10 per check. Each include, a, mx, ptr and exists term counts, as does a redirect, and includes nested inside other includes count too. Remove services you no longer use or move bulk senders to a subdomain.
How do I find my DKIM selector?
Open the headers of an email you sent and look for the DKIM-Signature line. The s= value is the selector and d= is the signing domain. Google Workspace uses google unless you chose another prefix, and Microsoft 365 uses selector1 and selector2.
Should SPF end in ~all or -all?
Both are valid. Google's setup guide recommends ~all (soft fail). Microsoft recommends -all (hard fail) when DKIM and DMARC are also set up. DMARC treats either one as an SPF failure.
Does a full pass here mean my emails will reach the inbox?
No. Inbox placement also depends on sender reputation, content, complaint rates and how each provider filters mail, none of which is visible in DNS. Passing these checks removes the most common setup reasons for rejection.
Is the domain I check stored anywhere?
Not by us. Your browser sends the lookups directly to the public resolver, which sees the names queried, as it would for any DNS lookup.
Related: SPF, DKIM and DMARC explained, What an MX record is, BIMI record guide, DNS lookup.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
More in Free Tools
- Email Header Analyzer
- Email List Syntax Checker
- Email Obfuscator
- Free Email Signature Generator
- Email Subject Line Tester | Free Tool
- Engagement Rate Calculator | Free Tool
- Free Estimate & Quote Template Generator
- Etsy Fee Calculator
Product
Who It's For
- For Agencies
- For Freelancers
- For Hosting Providers
- For SaaS Platforms
- For Startups
- For Financial Services
- For Healthcare
Features
Resources
- Blog
- Help Center
- Free Business Tools
- Free UI Components
- Website Templates
- Template Collections
- Website Examples
- Guides
- Comparisons
- Alternatives
- Best Lists
- Reviews
- Pricing Guides
- Use Cases
- Glossary & Guides
- Integrations
- Developers
- Benchmark
- Windows App