SPF, DKIM and DMARC Checker with MX Lookup
Enter a domain to check its email authentication live: the SPF record and its DNS lookup count, DKIM keys and their length, the DMARC policy and reports, and the MX mail servers. Each record gets pass, needs attention or fail with what to fix, and the domain gets a score out of 100.
You can also paste an email address or a website link. If your DKIM selector is not one of the common ones, enter it from the s= value of an email you sent. The result link can be shared.
What good records look like
| Record, DNS name: example value | Type |
|---|---|
SPF, @: v=spf1 include:_spf.google.com ~all | TXT |
DKIM, google._domainkey: v=DKIM1; k=rsa; p=MIIBIjANBg… | TXT |
DMARC, _dmarc: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com | TXT |
MX, @: 1 aspmx.l.google.com | MX |
Example check
| acme-example.com: finding | Result |
|---|---|
| SPF: Google and SendGrid includes, 3 of 10 lookups, ~all | Pass |
| DKIM: 2048-bit RSA key under the selector google | Pass |
| DMARC: p=quarantine, reports to dmarc@acme-example.com | Pass |
| MX: three Google Workspace servers, priority 1 and 5 | Pass |
| Score: 25 points for each pass, 12 for needs attention | 100 |
The SPF record has two includes, but SendGrid’s record includes one more, so the checker counts 3 lookups. A domain with no SPF record, DMARC at p=none without reports, a 1024-bit DKIM key and a single MX server scores 36: one fail and three items that need attention.
Fix order for cold email domains
Publish SPF and DKIM for every service that sends as your domain (your mailbox provider, CRM, help desk), then add DMARC with p=none and rua reports. After two to four weeks of clean reports, move to quarantine and reject. Send cold email from a separate domain or subdomain with the same three records, and check the wording with the email spam checker.
Frequently asked questions
How do I check my SPF record?
Enter your domain above. The checker reads the TXT record that starts with v=spf1, follows every include to count DNS lookups (the limit is 10), checks that there is only one SPF record and that it ends in ~all or -all, and lists what to fix.
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send email for your domain. DKIM signs each email with a key published in DNS, so receivers can see it was not changed. DMARC tells receivers what to do when an email fails both, and where to send reports. Gmail and Yahoo expect all three from bulk senders.
How do I find my DKIM selector?
Open an email you sent, show the original message or headers and find the DKIM-Signature line: the selector is the s= value, for example s=google or s=selector1. The checker tries 20 common selectors on its own, but a custom one has to be entered.
Which DMARC policy should I use?
Start with p=none and a rua= address to receive reports for two to four weeks. When the reports show that all your own services pass SPF or DKIM, move to p=quarantine and then to p=reject, which stops anyone from sending email as your domain.
What is an MX record?
An MX record names the mail servers that receive email for a domain, with a priority number: the lowest number is tried first. Without MX records the domain cannot receive replies, and some receivers distrust senders that cannot be replied to.
What happens when SPF has more than 10 lookups?
Receivers stop evaluating it and return a permanent error, so SPF fails for all your email. Every include, a, mx, ptr, exists and redirect counts, including the ones inside included records. Remove services you no longer use or replace includes with ip4 ranges.
Is the domain I check sent anywhere?
Only the DNS names are sent, from your browser to Google Public DNS (or Cloudflare if Google does not answer), the same lookups any mail server makes. Nothing is sent to SalesBond, and the records are public anyway.
Related tools: email spam checker, email format finder, email signature generator. More on sales and running a sales team on the SalesBond blog and the home page.
Official sources
- RFC 7208, Sender Policy Framework — one record, the limit of 10 DNS lookups, qualifiers of all.
- RFC 7489, DMARC — p, sp, pct and rua tags.
- Wikipedia, DomainKeys Identified Mail — selectors and key lengths.
- Gmail Help: email sender guidelines — SPF, DKIM and DMARC requirements for senders.
Updated on Nov 6, 2026. This calculator is for information only and is not tax, legal or payroll advice. The checker reads public DNS records at the moment you press Check; changes you have just made can take up to the record’s TTL (often an hour) to appear. It does not send a test email or check blacklists.
