The three records, in plain words
- SPF lists the servers allowed to send email for your domain. One record only, ending with
~allor-all, and no more than 10 DNS lookups once everyincludeis expanded. - DKIM signs each email with a key published in the DNS under a selector (
selector._domainkey.yourdomain.com). Every sending service (mail host, newsletter tool, online shop) has its own. - DMARC tells receivers what to do with an email that fails SPF and DKIM:
p=none(watch),quarantine(spam folder) orreject. Without DMARC, anyone can send email in your name.
Typical errors we detect
Two SPF records (both are then invalid), an SPF that exceeds 10 lookups after adding a newsletter service, a +all that allows the whole internet, a DMARC stuck at p=none for years, a DMARC record without an rua address so nobody reads the reports, a 1024-bit DKIM key that should be renewed in 2048 bits. Each problem comes with the fix to apply in your DNS zone.
DKIM not found: what does it mean?
DKIM cannot be listed: you have to know the selector. We test about thirty common selectors from the main mail hosts and sending services. If yours is different, type it in the second field: it is shown in the DKIM-Signature header of an email you sent (s= value). Not finding a key among the common selectors does not prove that DKIM is missing.
And after authentication?
A domain that is well authenticated can still be on a blocklist, especially after a hack or a former owner's spam. The full domain report checks the domain and IP blocklists used by mail servers; the blacklisted domain guide explains how to get delisted. Read also our domain security guide (DNSSEC, HSTS, security headers).
Frequently asked questions
Why do my emails go to spam?
The most frequent causes are a missing or invalid SPF, no DKIM signature, no DMARC record, or a domain or IP on a blocklist. This checker covers the first three; the full report covers blocklists.
Which DMARC policy should I choose?
Start with p=none and an rua address to receive reports, check that all your legitimate services pass, then move to quarantine and finally reject.
What is the SPF 10 lookup limit?
Each include, a, mx, ptr, exists or redirect mechanism costs a DNS lookup, nested ones included. Beyond 10, the SPF check fails with a permerror and your emails lose that authentication.
How do I find my DKIM selector?
Open an email you sent, show the original message and look for the DKIM-Signature header: the selector is the value after s=.