Email record lookup: MX, DMARC, DKIM, SPF

Is this domain's email set up correctly: MX, DMARC, DKIM and SPF?

How this check works

The check runs four lookups in the order mail actually uses them, and grades each one:

MX: where inbound mail for the domain is delivered, with each host's addresses.
DMARC: the policy at _dmarc.<domain>. If the domain is a subdomain with no record, we check the organisational domain it inherits from.
DKIM: public keys at <selector>._domainkey.<domain>. With a selector entered, we check only that one; otherwise we try about 40 common selectors.
SPF: the v=spf1 TXT record. We parse every term, follow all nested includes to count DNS lookups against the limit of 10, and flag risky endings like +all.

How to read the results

The verdict line counts problems across all four records. Each finding has a severity:

Fail breaks delivery or authentication, or violates a standard: no SPF or DMARC, two SPF records, more than 10 SPF lookups, DKIM keys under 1024 bits.
Warning works today but carries risk: DMARC at p=none, no report address, SPF at 8–10 lookups, a 1024-bit DKIM key, a key in test mode.
Pass means checked and correct.
Note is context, such as a policy inherited from the parent domain.

Each finding links to a guide section that explains why it matters and how to fix it. Where a record is missing, the fix includes a safe starter record you can copy.

DKIM: why "not found" isn't conclusive

DKIM selectors are chosen by each mail platform and can't be listed from DNS. If none of the common selectors match, DKIM may still be working. Open a message from the domain, find s= in its DKIM-Signature header, and enter that selector here. The DKIM guide shows where to look in Gmail and Outlook.

What this check can't see

DNS records show what a domain claims. They don't prove each sending platform signs with your domain, or that its envelope domain aligns with your From: address. For that, read the Authentication-Results header of a real message; DMARC alignment, explained shows how. To test whether a specific IP or range passes SPF, use the SPF validator.

Updated 26 October 2026

Related checks

Email Blacklist Check
Is this mail server's IP blocklisted, and is its reverse DNS set up the way receivers expect?
Email Header Analyzer
Why did this message arrive late, land in spam, or fail authentication?
SPF Validation
Is this IP address, or this whole range, allowed to send mail for the domain?

Guides for this check

DKIM selectors: finding, verifying and rotating keys
What a DKIM selector is, how to find the one your mail platform uses, how to verify the published key, and how to rotate keys without failed signatures.
DMARC alignment, explained: why SPF passes but DMARC fails
Which domains DMARC compares, relaxed vs strict alignment, and how to fix the most common "SPF pass, DMARC fail" and "DKIM pass, DMARC fail" cases.
DMARC from p=none to p=reject without breaking mail
How to move DMARC from monitoring to enforcement: what to publish, which reports to read, how long each stage takes, and what to do with what they find.
Gmail, Yahoo and Microsoft sender requirements, explained
What Gmail, Yahoo and Outlook.com require from senders in 2026: authentication and alignment, reverse DNS, one-click unsubscribe and spam-rate limits.

FAQ

What DMARC policy should I start with?

Begin with p=none and a rua= reporting address so you receive aggregate reports without affecting delivery. Review the reports, tighten to quarantine, then move to reject once all legitimate senders pass.

Why isn't DKIM found?

DKIM selectors are chosen by each mail platform and there's no standard name. If none of the common selectors match, find the selector from a real message's DKIM-Signature header and enter it.

What is the SPF 10-lookup limit?

SPF evaluation can trigger at most 10 DNS-querying terms (include, a, mx, ptr, exists, redirect). Going over this limit causes a permanent error and the SPF check fails.