Free tools · no account needed
Pre-check by domain
A free DMARC and SPF checker: enter a domain name and we look up the records published in DNS and check that they're set up correctly. Add a DKIM selector and the key is looked up too.
What the DNS check covers
We look up the same records a receiver reads when it checks your mail.
DMARC record
Whether the policy is p=none, quarantine or reject, and whether there is an address for reports (rua).
SPF record
Syntax and the number of DNS lookups. With more than one record, or more than 10 lookups, receivers can't evaluate SPF.
DKIM keys
Give a selector and we look up whether a public key is published under that name.
Mail server settings
MX records, MTA-STS, TLS-RPT, DANE and BIMI records, and the domain's expiration date.
Frequently asked questions
Where do I find my DKIM selector?
Open the source of a message you received and find the DKIM-Signature header: the value after s= is the selector. Google Workspace usually uses google, and Microsoft 365 uses selector1 and selector2. Not sure? Leave it empty and use the pre-check by email, which reads the selector from a real signature.
My DNS looks fine. Why is my email going to spam?
Correct DNS records don't guarantee that real email is sent the way they describe. When a sending service signs with its own domain, SPF and DKIM pass and DMARC still fails. Run the pre-check by email to see what a real message does. Spam filtering caused by content or sender reputation can't be seen from authentication settings.
Can I enter an IP address?
Yes. For an IP address we look up its reverse name (PTR). Receivers check that a sending server's IP has one, so it's worth a look if you run your own mail server. Private IP addresses can't be looked up.
Do you store the results?
No. We look at what your domain publishes once, when you run the check. The results aren't saved and the domain isn't added to an account. To stop abuse we keep a short-lived count of lookups, and when a lookup fails the domain name stays in our operations record so the failure can be traced.
After the pre-check, read your DMARC reports
A pre-check shows only what your domain publishes today and what one message did. With DMARC reports you see who is sending email as your domain, and the tasks that take you to p=reject, in order.