What this SPF, DKIM and DMARC checker looks at
SPF, DKIM and DMARC are the three DNS records receiving mail servers use to decide whether a message really comes from your domain. Without them, Gmail, Outlook and Yahoo treat your mail as unauthenticated, and since 2024 Gmail and Yahoo reject bulk mail that lacks them.
The checker reads the SPF record at the domain itself, the DMARC record at _dmarc.<domain>, and probes 30 common DKIM selectors (default, google, selector1, selector2, k1, s1, mailgun, sendgrid and others) at <selector>._domainkey.<domain>.
How to read the score
The score is out of 100. A valid SPF record is worth 30 points and a DKIM key on any probed selector another 30. DMARC is worth up to 40, depending on its policy: 40 for p=reject, 30 for p=quarantine, 15 for p=none.
Warnings explain what costs you deliverability: an SPF record that ends in +all (anyone may send as you), more than 10 DNS lookups in SPF (receivers stop evaluating it and treat it as a permanent error), a DMARC policy left at p=none, or no rua= address to receive aggregate reports.
Fixing the most common problems
Missing SPF: publish one TXT record starting with v=spf1 that lists every service sending on your behalf, ending in ~all while you test and -all once you are sure. Only one SPF record per domain is allowed; two records is an error, not a merge.
Missing DMARC: start with v=DMARC1; p=none; rua=mailto:you@yourdomain to collect reports without affecting delivery, then move to p=quarantine and p=reject once the reports show only legitimate senders.
Frequently asked questions
Why does the checker say no DKIM selector was found when I have DKIM set up?
DKIM keys live under a selector name your mail provider chooses, and DNS offers no way to list them. The checker probes the 30 most common names. If your provider uses another one, the key exists but is not found here. Look up the selector in your provider's DKIM settings or in the DKIM-Signature header (s=) of a message you sent.
What is the difference between ~all and -all in SPF?
~all is a softfail: mail from servers not listed should be accepted but marked as suspicious. -all is a hard fail: it should be rejected. Use ~all while you inventory your senders, then switch to -all.
Which DMARC policy should I use?
p=none only monitors, p=quarantine sends failing mail to spam and p=reject blocks it. Start with p=none and a rua= address, read the aggregate reports for a few weeks, then tighten to quarantine and reject.
Why is my SPF record failing with too many DNS lookups?
SPF allows at most 10 DNS lookups, and every include:, a, mx, ptr and exists mechanism counts, including those inside the records you include. Remove services you no longer use, or replace includes with the ip4: and ip6: ranges they resolve to.