Free Email Domain Check: SPF, DKIM, DMARC and MX

Records for

Want it set up for you?

Our business email service puts your mailboxes on your own domain and sets SPF, DKIM and DMARC for every tool that sends as you: your inbox, your CRM, your invoices and your website forms. Then we test each one.

See business email setup

What we look up

Four records decide where your mail lands.

MX

Where mail for you@yourdomain gets delivered. No MX record means a customer who replies to your quote has nowhere reliable to send it.

SPF

The list of servers allowed to send as your domain. One record only, and no more than 10 DNS lookups inside it, or it stops working for every message.

DKIM

A signature on each message, checked against a key you publish in DNS. Each service that sends for you signs with its own key under its own selector name.

DMARC

Your instructions for mail that fails SPF and DKIM: no preference, treat it as suspicious (usually the spam folder), or refuse it. It also asks for reports on who is sending as you.

Why it matters now

Gmail and Yahoo set rules for these records.

Since February 1, 2024, Google's sender guidelines have required everyone who sends to Gmail accounts to set up SPF or DKIM. Senders of 5,000 or more messages a day to personal Gmail accounts also need SPF, DKIM and DMARC, with the visible From domain aligned with SPF or DKIM. A DMARC policy of p=none is allowed.

Yahoo's sender best practices set the same floor: SPF or DKIM at a minimum for everyone, and both plus a valid DMARC policy of at least p=none for bulk senders, with enforcement that began in February 2024.

A small service business rarely sends 5,000 emails a day, so the bulk rules may not apply to you. The records still decide whether a quote, an invoice or a seasonal reminder looks like it came from you. For the full background, read SPF, DKIM and DMARC explained and the Google and Yahoo sender requirements.

How we grade

What each result means

The rules come from the standards: RFC 7208 for SPF (one record, at most 10 DNS lookups, ptr should not be published), RFC 9989 for DMARC (published May 2026: more than one record and receivers discard them all), and RFC 7505 for a null MX.

Record	Looks right	Worth fixing	Missing or broken
MX	At least one mail server is listed	A null MX record: the domain says it accepts no email	No MX records at all
SPF	One record, 10 DNS lookups or fewer, ending in ~all or -all	Ends in ?all or has no all, or uses ptr	No record, more than one, more than 10 lookups, +all, an include with no SPF record, or a term that isn't valid
DKIM	A key at one of the selectors we try	Only empty keys, which means revoked	Never marked broken. With no key found, it reads "not found for common selectors"
DMARC	p=quarantine or p=reject	p=none, no p= at all, or a policy that isn't valid when a report address is set	No record, more than one, or a policy that isn't valid and no report address

For a subdomain with no DMARC record of its own, we also check its parent domain, the way RFC 9989 tells receivers to look. SPF lookups are counted the way RFC 7208 counts them: each include, a, mx, ptr and exists, plus a redirect, including the includes inside includes.

DKIM selectors

Why DKIM can come back "not found"

A selector is the name a service files its key under, and DNS has no way to list them. So we try the names below, and if none has a key we say so instead of calling it a failure.

Selector we try	Named in
google	Google Workspace's DKIM help: the default prefix
selector1, selector2	Microsoft 365's DKIM help: the same two names for every organization
resend	Resend's DNS setup guides
s1, s2	SendGrid's domain authentication help, in its example records
k2	Mailchimp's domain authentication help, in its troubleshooting example
k3, default, dkim, mail, smtp	Common names we try with no vendor claim attached

To find yours, open a message you sent in Gmail and choose Show original. In the DKIM-Signature header, s= is the selector and d= is the domain that signed it (RFC 6376). If d= is the vendor's domain instead of yours, finish that vendor's domain setup.

What it can't see

The limits, said plainly.

Whether each tool that sends as you actually signs with your domain. Only a test message shows that.
DKIM keys under selector names we don't try.
Your sender reputation, your complaint rate or what's in your messages.
Anything inside your inbox or your email host's admin settings. We read public DNS only.

Questions

Straight answers.

Is it free, and do you keep the domain I type?

It's free, and the results show on this page with no sign-up. The domain goes to our server only so it can look up DNS records. The check doesn't save or log it. Netlify, which hosts this site, may process technical details such as your IP address, as our privacy policy says.

Why does DKIM say "not found for common selectors"?

DKIM keys live under a selector name the sending service picks, and DNS can't list them. We try the names in the table above. If yours uses another name, open a message you sent in Gmail, choose Show original, and read s= (the selector) and d= (the signing domain) in the DKIM-Signature header.

Everything passes. Why do my emails still land in spam?

Records are the floor. Each service that sends as you (your CRM, invoices, website forms, marketing tool) also has to pass SPF or DKIM for your domain, and DNS alone can't show that. Send a test from each one and read the results, as in how to check if your emails go to spam.

How soon does a DNS change show up here?

Often within minutes, but DNS answers are cached until they expire, so an old record can linger. Google says a new DKIM key can take up to 48 hours to start working. Run the check again the next day before you assume something is broken.

Does this send email or visit my website?

No. It reads public DNS records and nothing else. It doesn't send a message, connect to your mail server or load your website.

Sources

Email on your own domain, set up right.

Mailboxes on Google Workspace or Microsoft 365, with SPF, DKIM and DMARC for every tool that sends as you, all in your company's name.

See business email setup