Free tool
SPF, DKIM and DMARC check: will your mail arrive?
Enter a domain. We read its SPF, DKIM and DMARC records and its MX records from DNS, check them the way receiving mail servers do, and tell you in plain words what is missing or wrong, with example records you can paste into your DNS. No connection to your mail server, nothing stored.
What these results mean
- SPF
- A TXT record listing the servers allowed to send mail for your domain. Receivers check the connecting server against it. Limits: one record, at most 10 DNS lookups, and a closing ~all or -all. SPF alone breaks on forwarding, which is why DKIM exists.
- DKIM
- Your mail server signs every message with a private key; the public key is published at selector._domainkey.yourdomain. Receivers verify the signature, which survives forwarding. Use RSA keys of 2048 bits, and rotate them now and then.
- DMARC
- A TXT record at _dmarc.yourdomain that tells receivers what to do when SPF and DKIM fail (none, quarantine, reject) and where to send reports. Alignment means the domain in the From header must match the SPF or DKIM domain. Start with p=none, read the reports, then tighten.
- MX
- The servers that receive mail for the domain. Not needed for sending, but major receivers distrust domains without MX records; and without them, replies bounce.
- Why it matters
- Large mailbox providers require SPF or DKIM for everyone and DMARC for bulk senders; without them, mail lands in spam or is rejected. The same records stop others from sending phishing mail in your name.
- Keep it that way
- Records change when you add a newsletter tool, move hosting or rotate keys. Centoculus checks SPF, DKIM, DMARC, MTA-STS and DNSSEC of your domain every hour and alerts you when something changes; the mail delivery check also sends a test message and tells you where it landed.
Want this checked automatically and get alerted?
Centoculus checks your site every 5 minutes on the free plan and alerts you by email and in the app before your customers notice. 50 website monitors and 5 SSL checks a day, free, commercial use allowed. Sign-up opens soon: get early access and you start first.
Get early accessQuestions about SPF, DKIM and DMARC
What is the difference between SPF, DKIM and DMARC?
SPF says which servers may send for your domain. DKIM proves with a signature that a message was not changed and really comes from your server. DMARC ties both to the visible From address and tells receivers what to do when they fail. You need all three.
What is a DKIM selector and where do I find it?
The selector names the key in DNS: selector._domainkey.yourdomain. Your mail provider tells you the name when you set up DKIM (Google uses "google", Microsoft 365 "selector1" and "selector2"). You can also read it from the DKIM-Signature header of any mail you sent: the s= tag.
Why does SPF have a 10-lookup limit?
Every include, a, mx, ptr, exists and redirect makes the receiver query DNS. The standard caps this at 10 per check to prevent abuse. Above the limit the receiver returns a permanent error, which most treat as a fail. Providers that need many lookups offer a flattened include.
Should I use ~all or -all?
-all tells receivers to reject mail from other servers, ~all to treat it as suspicious. With DMARC at quarantine or reject the difference is small, because DMARC decides. Start with ~all while you are not sure you listed every sender, then switch to -all.
Which DMARC policy should I start with?
p=none with a rua address. Read the reports for a few weeks, add every legitimate sender to SPF and DKIM, then move to p=quarantine and finally p=reject. Jumping to reject on day one usually blocks a newsletter tool or a CRM nobody remembered.
How long until DNS changes take effect?
Usually minutes, at most the TTL of the old record (often up to 24 hours). Run this check again after the change; it reads DNS fresh every time.
My records are fine, but mail still lands in spam.
Authentication is only the entry ticket. Content, list quality, complaint rate and the reputation of the sending IP matter too. Check whether the sending IP is on a blocklist and whether your reverse DNS matches the mail server name.