SPF, DKIM and DMARC checker with suggested fixes
Check SPF, DKIM, DMARC, MX, MTA-STS and BIMI for any domain in plain words, with a corrected record to copy when one is needed.
What we check
SPF, DKIM, DMARC, MX, MTA-STS, BIMI and a corrected record
We check the DNS records that decide whether a domain’s email is trusted. The summary comes first, in plain words: what is set up, what is missing, and what that means for delivery to Gmail, Outlook and Yahoo. If SPF or DMARC needs a change, you get a corrected record to copy; publish it and check again.
- SPF. Which servers may send mail for the domain: every mechanism, the ending (-all, ~all, ?all or +all), and the number of DNS lookups the record needs. More than 10 makes SPF fail everywhere.
- DKIM. Whether a signing key is published. DKIM keys live under a selector name that only a sent message reveals, so we try 20 common selectors (google, selector1, selector2, k1, default, s1, s2, protonmail, fm1 and others) plus the one you enter, and say which ones we tried.
- DMARC. The policy for mail that fails (p=none, quarantine or reject), the subdomain policy (sp=), the share it applies to (pct=) and where optional reports go (rua=).
- MX. Which servers receive the domain’s mail, and which email service that is.
- MTA-STS and TLS reporting. Whether senders must use verified encryption when delivering to you (the _mta-sts record and its policy file).
- BIMI. Whether the domain publishes a logo for inboxes that support it.
- A corrected record. If SPF or DMARC is missing or wrong, you get a corrected record for the same DNS name to copy: for SPF, your own mechanisms with the problem fixed; for DMARC, the next step towards p=reject. We do not guess which sending services you still use, and we never drop one.
Example result
github.com, and suggested records for example.org
Example: our check of github.com on Sep 29, 2026.
Mail for github.com is handled by Microsoft 365. SPF, DKIM and DMARC are all in place, with DMARC set to quarantine. Large mailbox providers such as Gmail and Yahoo can authenticate mail from this domain.
The SPF record needs 10 DNS lookups, exactly the limit. One more include (for example a new newsletter service) would make SPF fail for all of its mail. No MTA-STS policy.
Example of suggested records (not a real check): example.org is a reserved documentation domain.
Mail for example.org is handled by Google Workspace. SPF needs attention and there is no DMARC record. The SPF record ends in ?all and uses the deprecated ptr mechanism.
SPF now: v=spf1 include:_spf.google.com ptr ?all
Suggested SPF: v=spf1 include:_spf.google.com ~all
Suggested DMARC on _dmarc.example.org: v=DMARC1; p=none. Reports are optional: to receive them, add rua=mailto: with an address you control. When only your own services send mail as the domain, check again for the next step.
Email hosting prices we measure
8 plans
If your domain’s mail runs on one of these services, its plans are highlighted here after the check. Prices come from our own dated checks of each pricing page, as shown in the United States, in the currency of each page, not converted. Annual billing is shown as its monthly equivalent.
| Service and plan | Monthly billing | Annual billing, per month | Checked |
|---|---|---|---|
| Fastmail Individual | $6.00/month | $5.00/month | |
| Google Workspace Standard | — | $14.00/month per user | |
| Google Workspace Starter | — | $7.00/month per user | |
| Microsoft 365 Business Basic (last confirmed Oct 17, 2026) | — | $7.00/month per user | |
| Microsoft 365 Business Premium with Copilot (last confirmed Oct 17, 2026) | — | $32.00/month per user | |
| Microsoft 365 Business Standard with Copilot (last confirmed Oct 17, 2026) | — | $23.50/month per user | |
| Proton Mail Plus | $4.99/month | $3.99/month | |
| Proton Unlimited | — | $9.99/month |
Limits
DNS and one policy file; no mail server, STARTTLS or blocklist tests
- A DKIM key is found under the selector you enter or one of the common names. Enter the selector from the
s=tag of the DKIM-Signature header of a message the domain sent, and we check it too. - For a subdomain without its own DMARC record we look one level up; a full organisational-domain lookup is not done.
- We read DNS and one policy file only. We do not connect to mail servers, test STARTTLS or check blocklists.
- Suggested records are built only from what the check read. Compare them with your mail provider’s help pages before you publish: we cannot know every service that sends mail for you.
- We do not watch your domain. To see a change, run the check again after you publish it.
Other free tools: What is my IP? Public IP and WebRTC check, Who is hosting this website? Hosting checker. All tools: Caliper Press tools.