What is the difference between SPF, DKIM and DMARC?

SPF is a list of the servers allowed to send email for your domain. DKIM is a signature your email provider adds to every message so the receiver can prove it was not altered. DMARC tells receivers what to do when a message fails those checks (nothing, spam folder, or reject) and where to send reports. You want all three.

Do I need DMARC if I only send a few emails a day?

Gmail makes DMARC mandatory for anyone sending 5,000 or more messages a day to Gmail accounts, and Yahoo has a similar rule for bulk senders. Everyone else still needs SPF or DKIM. A basic DMARC record costs nothing, takes five minutes, and stops other people from sending mail that looks like it came from you, so there is little reason to skip it.

Why does the checker say DKIM was not found when I know it is on?

DKIM keys are published under a selector name that your email provider chooses, and there is no way to list every selector on a domain. We check the common ones (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Resend and generic defaults). If your provider uses a custom name, your email admin panel shows it. That is why a missing DKIM key is shown as a note, not a failure.

Is my domain or data stored anywhere?

We do not store it. The lookups run in your browser and go to Google Public DNS, which handles them under Google's own privacy policy. DNS records are public by design, so nothing private is revealed by checking them.

I fixed my records. Why does the checker still show the old ones?

DNS changes take time to spread. Most show up within an hour, but a record can be cached for as long as its TTL, which some providers set to 24 hours or more. Check again later before changing anything else.

Should I use ~all or -all at the end of my SPF record?

Either is fine once DMARC is in place, because DMARC makes the final call. ~all (soft fail) is the safer choice while you are still finding every service that sends for you. -all (hard fail) is stricter. Never use +all, which authorizes every server on the internet.

SPF, DKIM and DMARC checker

Enter your domain to see whether your SPF, DKIM, DMARC and MX records are set up correctly, and exactly what to change if they are not. Free, no sign-up, results in a few seconds.

Lookups run in your browser through Google Public DNS. We check DKIM on 12 common selectors. Nothing you enter is stored.

What this checker looks at

Every email you send is judged by the receiving server before anyone reads it. Three DNS records decide most of that judgment, and a fourth decides whether replies can reach you at all.

SPF lists the servers allowed to send as your domain. We check that exactly one record exists, that it does not end in +all, and, following every include, that it stays within the 10 DNS lookups the standard allows.³
DKIM is a cryptographic signature on each message. We look for a published key on the selectors the major providers use.
DMARC tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. We read the policy (p=none, quarantine or reject) and flag a missing report address.⁴
MX records say where mail for your domain is delivered. Without them, customer replies bounce.

Why this matters more since 2024

In February 2024 Gmail and Yahoo started enforcing sender requirements. Every sender now needs SPF or DKIM, and bulk senders (Gmail draws the line at 5,000 messages a day to its users) need SPF, DKIM and a DMARC record.¹² Mail that misses the bar goes to spam or is rejected outright.

For a service business, that email is usually the estimate, the invoice, the appointment reminder, or the follow-up after a quote. When those land in spam, it looks exactly like a customer who went quiet.

How to fix what the checker finds

Find where your DNS lives. That is usually your domain registrar (GoDaddy, Namecheap, Squarespace) or Cloudflare. It is not always the company that hosts your website.
Fix SPF first. Keep one TXT record that starts with v=spf1 and includes every service that sends for you: your mailbox provider, your CRM, your invoicing tool.
Turn on DKIM in each sending service. Each one gives you a record to add. Google Workspace and Microsoft 365 both have a DKIM switch in the admin console.
Add DMARC at p=none with a report address. Read the reports for a couple of weeks, fix any legitimate sender that fails, then tighten to p=quarantine.
Run this check again once the changes have had time to spread.

Every follow-up that lands in spam is a follow-up that never happened, whether it is sent from your inbox or from a CRM like ours. If you would rather not touch DNS yourself, book a call and we will go through your report with you.

Want someone to fix it for you?

Book a 30-minute call. Bring your report and we will tell you what to change, no charge.

Book a call

More free tools: local business schema generator, all tools.

Frequently asked questions

What is the difference between SPF, DKIM and DMARC?: SPF is a list of the servers allowed to send email for your domain. DKIM is a signature your email provider adds to every message so the receiver can prove it was not altered. DMARC tells receivers what to do when a message fails those checks (nothing, spam folder, or reject) and where to send reports. You want all three.
Do I need DMARC if I only send a few emails a day?: Gmail makes DMARC mandatory for anyone sending 5,000 or more messages a day to Gmail accounts, and Yahoo has a similar rule for bulk senders. Everyone else still needs SPF or DKIM. A basic DMARC record costs nothing, takes five minutes, and stops other people from sending mail that looks like it came from you, so there is little reason to skip it.
Why does the checker say DKIM was not found when I know it is on?: DKIM keys are published under a selector name that your email provider chooses, and there is no way to list every selector on a domain. We check the common ones (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Resend and generic defaults). If your provider uses a custom name, your email admin panel shows it. That is why a missing DKIM key is shown as a note, not a failure.
Is my domain or data stored anywhere?: We do not store it. The lookups run in your browser and go to Google Public DNS, which handles them under Google's own privacy policy. DNS records are public by design, so nothing private is revealed by checking them.
I fixed my records. Why does the checker still show the old ones?: DNS changes take time to spread. Most show up within an hour, but a record can be cached for as long as its TTL, which some providers set to 24 hours or more. Check again later before changing anything else.
Should I use ~all or -all at the end of my SPF record?: Either is fine once DMARC is in place, because DMARC makes the final call. ~all (soft fail) is the safer choice while you are still finding every service that sends for you. -all (hard fail) is stricter. Never use +all, which authorizes every server on the internet.

Sources

1.Google Workspace Admin Help: Email sender guidelines (https://support.google.com/a/answer/81126)
2.Yahoo Sender Hub: Sender best practices (https://senders.yahooinc.com/best-practices/)
3.RFC 7208: Sender Policy Framework (SPF), including the 10 DNS lookup limit (https://www.rfc-editor.org/rfc/rfc7208)
4.RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) (https://www.rfc-editor.org/rfc/rfc7489)