Email Deliverability Checker: SPF, DKIM, DMARC& MX

What this checker tests

Mailbox providers decide whether your email is really from you before they look at a single word of it. They do that with three DNS records: SPF, DKIM and DMARC. If any of them is missing or broken, even a well-written email to a clean list can go to spam or be rejected. The checker reads all three, plus your MX records (so replies and bounces have somewhere to go) and BIMI (optional), then scores the domain out of 100: SPF 30 points, DMARC 35, DKIM 25, MX 10.

SPF: who is allowed to send as you

SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send mail using your domain in the envelope sender. A typical record looks like v=spf1 include:_spf.google.com ~all. Each service that sends as you, such as your mailbox provider, CRM, helpdesk or cold email tool, needs to be in that one record.

Only one SPF record per domain

A second v=spf1record doesn't add to the first. It breaks both. Receivers return a permanent error and SPF fails. This usually happens when a new tool's setup guide says "add this SPF record" and someone adds it instead of merging it in.

The 10 DNS lookup limit

SPF allows at most 10 DNS lookups while evaluating a record. Every include, a, mx, ptr and exists counts, as does redirect. So does everything nested inside each include, which is how a record with five includes can quietly hit 12. ip4, ip6 and all are free. Over the limit, SPF fails outright. This checker follows every include recursively and shows the real total.

~all, -all, ?all and +all

The all at the end says what to do with servers you didn't list. ~all (softfail) and -all (fail) both protect you. ?all is neutral and gives receivers no signal. +all lets anyone on the internet pass SPF as you, and spam filters treat it as a red flag.

DKIM: a signature on every email

DKIM (DomainKeys Identified Mail) has your email provider sign each outgoing message with a private key. The matching public key is published in DNS at selector._domainkey.yourdomain.com, and the receiver uses it to confirm the message wasn't altered and really came from a server holding your key. Unlike SPF, DKIM usually survives forwarding.

The selector is the catch. There's no way to list a domain's selectors from DNS, so every checker has to guess. We probe the ones the major providers use. If yours is custom, open an email you sent, view the original headers, and look for s=in the DKIM-Signature header. Enter that value under "Know your DKIM selector?" above. Use a 2048-bit key where your provider supports it.

DMARC: the policy that ties it together

DMARC is a TXT record at _dmarc.yourdomain.com. A message passes DMARC when SPF or DKIM passes and the domain that passed matches the domain in the visible From address. That match is called alignment. The p= tag tells receivers what to do with mail that fails, and rua= tells them where to send daily aggregate reports about who is sending as your domain.

• p=none: monitoring only. Failing mail is delivered as normal.
• p=quarantine: failing mail goes to spam.
• p=reject: failing mail is refused. This is full protection against spoofing.

A safe DMARC rollout: none → quarantine → reject

1. Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com and collect reports for two to four weeks.
2. Use the reports to find every legitimate sender that fails, and fix its SPF include or DKIM signing.
3. Move to p=quarantine. If you want to be careful, ramp pct from 25 to 50 to 100.
4. Once quarantine has run clean, move to p=reject.

Gmail and Yahoo sender requirements

Since February 2024, Gmail and Yahoo require every sender to authenticate with SPF or DKIM and to keep spam complaints low. Bulk senders (Google's threshold is roughly 5,000 messages a day to personal Gmail accounts) must also:

• authenticate with both SPF and DKIM;
• publish a DMARC record with at least p=none;
• align the From domain with the SPF or DKIM domain;
• offer one-click unsubscribe on marketing mail and honour it within two days;
• keep the spam rate in Google Postmaster Tools below 0.3% (see the sourced figures on our data page).

Microsoft applies similar rules to high-volume senders to Outlook.com: mail that doesn't pass SPF, DKIM and DMARC is rejected with error 550 5.7.515. You can see every threshold and its source on our B2B outbound and deliverability statistics page.

How to read your results

Fail means receivers are likely rejecting or spam-foldering your mail right now. Fix these first. Warning means it works but leaves you exposed, like DMARC at p=noneor an SPF record close to 10 lookups. The fixes list is ordered high to medium to low priority, and where we can say it, it gives the exact host and value to paste into your DNS provider. DNS changes usually take effect within minutes but can take up to the record's TTL (often an hour) to show everywhere.

A clean score here means your domain is authenticated. It doesn't guarantee the inbox: sending volume, list quality, bounce rates and copy still matter. For the rest of the picture, read why cold emails go to spam and 7 fixes and our step-by-step SPF, DKIM and DMARC setup checklist.

Frequently asked questions