Daniel Lasek · Last reviewed 2026-11-01
Email Security Checker (SPF, DKIM, DMARC): how it works and what to fix
This checker reads the public DNS records that decide whether mail from your domain is trusted: SPF, DKIM, DMARC, your MX servers, and the optional MTA-STS, TLS-RPT and BIMI records. It tells you what is missing or broken in plain English and gives you records to paste into your DNS. It does not send email and does not log in anywhere.
Why does this matter now?
In February 2024 Gmail and Yahoo started enforcing new sender rules. Every sender needs SPF or DKIM. Anyone sending around 5,000 or more messages a day to Gmail needs SPF, DKIM and a DMARC record (p=none is the minimum), and the domain in the From line has to match the domain SPF or DKIM checked. Microsoft applied the same rule to Outlook.com, Hotmail and Live addresses in 2025. Mail that misses these rules goes to spam or is refused.
Small senders are not off the hook. Filters lean on the same signals for everyone, so a domain with no DMARC and a sloppy SPF record simply looks less trustworthy than one that has them.
What do SPF, DKIM and DMARC actually do?
SPF is one TXT record at your domain that lists who may send for it, for example v=spf1 include:_spf.google.com ~all. Receivers compare the sending server with that list.
DKIM puts a signature on every message. The matching public key lives in DNS at selector._domainkey.yourdomain.com. If the message is changed on the way, or was never signed by you, the check fails.
DMARC is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do when a message fails both SPF and DKIM for the domain in the From line (nothing, spam folder, or reject), and asks them to send you daily reports.
You need all three. SPF alone breaks when mail is forwarded, DKIM alone says nothing about what to do with a fake, and DMARC without the other two has nothing to check.
What this checker looks at
- MX: which servers receive your mail, and from that, which provider you use (Google Workspace, Microsoft 365, Zoho, Proton, Fastmail and others).
- SPF: that there is exactly one record, that the syntax is valid, how it ends (
~all,-all,?allor+all), and how many DNS lookups it costs. We follow everyinclude,a,mx,existsandredirectdown the chain, because receivers stop at 10 lookups and treat the record as broken after that. We also count "void" lookups, names that return nothing, which are limited to 2. - DMARC: the policy (
p=none,quarantineorreject), the subdomain policy,pct, where reports go (rua,ruf), and alignment mode. If a subdomain has no record, we look at the parent domain's, the same way receivers do. - DKIM: we try a list of common selectors (google, selector1 and selector2 for Microsoft 365, k1 for Mailchimp, s1 and s2, default, zoho, protonmail and more) plus the one you type in, and report the key type and length for anything we find.
- Extras: MTA-STS and TLS-RPT (encrypted delivery to you) and BIMI (logo in the inbox). These are optional.
Why does my SPF record break at 10 lookups?
Every include: costs one DNS lookup, and so does every include inside it. Google Workspace and Microsoft 365 each cost 1 today. Add a newsletter tool, a helpdesk, a CRM and a shop platform and you can pass 10 without noticing, because the extra lookups are hidden inside other companies' records. Past 10, receivers return a "permerror" and SPF fails for all of your mail, including the mail that was fine yesterday.
The fix is to remove services you no longer use, replace a and mx with the ip4: addresses they point to, and, if you really need more, ask the heaviest service for a slimmer include or use SPF flattening. The SPF record checker shows the full lookup tree.
How do you roll out DMARC without losing mail?
- Publish
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;and create that mailbox (or use a DMARC report service). Nothing is blocked yet. - Read the reports for two to four weeks. Every service that sends as you (website, newsletter, invoicing, CRM) should pass SPF or DKIM with your domain. Fix the ones that do not, usually by turning on DKIM in that service.
- Move to
p=quarantine, optionally withpct=25and then higher. Failing mail goes to spam. - When nothing real is failing, move to
p=reject. Spoofed mail is refused.
The checker shows which step you are on and gives you the next record. More detail is on the DMARC checker page.
What does a hacked website have to do with email?
A lot. One of the first things attackers do with a hacked WordPress site is use it to send spam: fake login pages, pharma spam, phishing. The mail leaves from your web server. If your SPF record allows that server (through a, mx, an ip4 or a hosting include, which is common on shared hosting), the spam passes SPF and even DMARC under your domain. Receivers then learn that your domain sends junk, and your real mail starts landing in spam. Hosts also suspend accounts and blocklist server addresses when this happens.
Good SPF and DMARC stop strangers from faking your domain. They cannot stop spam sent from a server you have authorised. If mail trouble started suddenly and your DNS has not changed, check the website as well. The free Laskyr scan looks for public signs of a hack. If you find one, Emergency Cleanup is $499 and includes a written report.
What this check cannot tell you
DNS shows what you published, not what happens to each message. We cannot see whether your messages are signed with the key we found, whether the From domain aligns, whether your sending server is on a blocklist, or whether your content trips spam filters. Send yourself a message at a Gmail address, open it, choose "Show original", and look for SPF: PASS, DKIM: PASS and DMARC: PASS. Your DMARC reports show the same thing for every receiver.
Questions
Why are my emails going to spam?
The most common DNS causes are a missing or broken SPF record, no DKIM signature, and no DMARC record. Since February 2024 Gmail and Yahoo filter or reject mail that fails these checks much more often. Content, a sudden jump in volume, spam complaints and a blocklisted sending server matter too, and a hacked website sending spam from your server can cause all of them at once.
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for your domain. DKIM adds a signature to each message that receivers check against a public key in your DNS. DMARC ties them to the address people see in the From line, tells receivers what to do when both fail, and sends you reports.
The checker says no DKIM key was found. Is DKIM missing?
Not necessarily. A DKIM key sits under a selector name chosen by your email service, and DNS cannot list them. We try a few dozen common names. If your provider uses a custom one, open a message you sent, view the original headers, find s= in the DKIM-Signature line, and enter that selector.
Should SPF end in ~all or -all?
Either is fine once DMARC is in place. ~all (soft fail) is the common choice and is what Google recommends. -all (hard fail) is stricter. Never use +all, which allows every server on the internet, and avoid ?all, which protects nothing.
Is it safe to set DMARC to p=reject straight away?
Only for a domain that sends no email at all. For a domain you use, start at p=none with a report address, fix every real sender the reports show failing, then move to quarantine and finally reject. Jumping straight to reject can silently drop your own invoices or newsletters.
Do you send a test email or connect to my mail server?
No. The check reads public DNS records only. It cannot see whether a specific message passed; for that, look at the Authentication-Results header of a message you sent, or at your DMARC reports.