Email record lookup: MX, DMARC, DKIM, SPF

Is this domain's email set up correctly: MX, DMARC, DKIM and SPF?

MX

0 . (null MX)

Note
F1Null MX: this domain says it accepts no email
A single MX record pointing to "." (RFC 7505) tells senders not to try. That is correct for domains that never receive mail; anything else will bounce immediately.
Why this matters and how to fix it →

No MX records returned.

DMARC

_dmarc.example.com → v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s

Warning
F1No aggregate report address (rua=)
Without rua= you get no reports, so you can't see who is sending as your domain or safely tighten the policy.
FixAdd rua=mailto:<address> pointing at a mailbox or a DMARC report service.
Why this matters and how to fix it →
Pass
F2DMARC policy is enforced (p=reject)
v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s

Tag	Meaning	Value
v	Version	DMARC1
p	Policy	reject
sp	Subdomain policy	reject
adkim	DKIM alignment	s
aspf	SPF alignment	s

DKIM

default._domainkey.example.com · google._domainkey.example.com · s1._domainkey.example.com · s2._domainkey.example.com · selector1._domainkey.example.com · selector2._domainkey.example.com

Note
F1Selector default: key revoked (empty p=)
An empty p= deliberately revokes a key. Mail still signed with it fails DKIM.
Why this matters and how to fix it →
Note
F2Selector google: key revoked (empty p=)
An empty p= deliberately revokes a key. Mail still signed with it fails DKIM.
Why this matters and how to fix it →
Note
F3Selector s1: key revoked (empty p=)
An empty p= deliberately revokes a key. Mail still signed with it fails DKIM.
Why this matters and how to fix it →
Note
F4Selector s2: key revoked (empty p=)
An empty p= deliberately revokes a key. Mail still signed with it fails DKIM.
Why this matters and how to fix it →
Note
F5Selector selector1: key revoked (empty p=)
An empty p= deliberately revokes a key. Mail still signed with it fails DKIM.
Why this matters and how to fix it →
Note
F6Selector selector2: key revoked (empty p=)
An empty p= deliberately revokes a key. Mail still signed with it fails DKIM.
Why this matters and how to fix it →

Selector	Key	Size	Record
default	rsa	revoked	v=DKIM1; p=
google	rsa	revoked	v=DKIM1; p=
s1	rsa	revoked	v=DKIM1; p=
s2	rsa	revoked	v=DKIM1; p=
selector1	rsa	revoked	v=DKIM1; p=
selector2	rsa	revoked	v=DKIM1; p=

SPF

0 of 10 DNS lookups · v=spf1 -all

Pass
F1SPF record is valid (0/10 lookups)
v=spf1 -all

Term	Qualifier	Mechanism	Value
-all	-	all	—

Warning

example.com works, with 1 warning worth fixing.

0 fail · 1 warning · 2 pass · 7 note

Raw data

{
  "domain": "example.com",
  "mx": {
    "status": "ok",
    "null_mx": true,
    "records": [],
    "ttl": 300
  },
  "dmarc": {
    "status": "ok",
    "name": "_dmarc.example.com",
    "queried": "example.com",
    "checkedOrg": null,
    "record": "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s",
    "records": [
      "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"
    ],
    "multiple": false,
    "inherited_from": null,
    "tags": [
      {
        "tag": "v",
        "label": "Version",
        "value": "DMARC1"
      },
      {
        "tag": "p",
        "label": "Policy",
        "value": "reject"
      },
      {
        "tag": "sp",
        "label": "Subdomain policy",
        "value": "reject"
      },
      {
        "tag": "adkim",
        "label": "DKIM alignment",
        "value": "s"
      },
      {
        "tag": "aspf",
        "label": "SPF alignment",
        "value": "s"
      }
    ],
    "unknownTags": [],
    "ttl": 300
  },
  "dkim": {
    "records": [
      {
        "selector": "default",
        "name": "default._domainkey.example.com",
        "record": "v=DKIM1; p=",
        "ttl": 300,
        "keyType": "rsa",
        "bits": null,
        "revoked": true,
        "testing": false
      },
      {
        "selector": "google",
        "name": "google._domainkey.example.com",
        "record": "v=DKIM1; p=",
        "ttl": 300,
        "keyType": "rsa",
        "bits": null,
        "revoked": true,
        "testing": false
      },
      {
        "selector": "s1",
        "name": "s1._domainkey.example.com",
        "record": "v=DKIM1; p=",
        "ttl": 300,
        "keyType": "rsa",
        "bits": null,
        "revoked": true,
        "testing": false
      },
      {
        "selector": "s2",
        "name": "s2._domainkey.example.com",
        "record": "v=DKIM1; p=",
        "ttl": 300,
        "keyType": "rsa",
        "bits": null,
        "revoked": true,
        "testing": false
      },
      {
        "selector": "selector1",
        "name": "selector1._domainkey.example.com",
        "record": "v=DKIM1; p=",
        "ttl": 300,
        "keyType": "rsa",
        "bits": null,
        "revoked": true,
        "testing": false
      },
      {
        "selector": "selector2",
        "name": "selector2._domainkey.example.com",
        "record": "v=DKIM1; p=",
        "ttl": 300,
        "keyType": "rsa",
        "bits": null,
        "revoked": true,
        "testing": false
      }
    ],
    "searched": "32 common selectors",
    "status": "ok"
  },
  "spf": {
    "record": "v=spf1 -all",
    "status": "ok",
    "records": [
      "v=spf1 -all"
    ],
    "error": null,
    "terms": [
      {
        "raw": "-all",
        "qualifier": "-",
        "name": "all",
        "value": null,
        "modifier": false
      }
    ],
    "lookups": 0,
    "voids": 0,
    "warnings": []
  }
}

How this check works

The check runs four lookups in the order mail actually uses them, and grades each one:

MX: where inbound mail for the domain is delivered, with each host's addresses.
DMARC: the policy at _dmarc.<domain>. If the domain is a subdomain with no record, we check the organisational domain it inherits from.
DKIM: public keys at <selector>._domainkey.<domain>. With a selector entered, we check only that one; otherwise we try about 40 common selectors.
SPF: the v=spf1 TXT record. We parse every term, follow all nested includes to count DNS lookups against the limit of 10, and flag risky endings like +all.

How to read the results

The verdict line counts problems across all four records. Each finding has a severity:

Fail breaks delivery or authentication, or violates a standard: no SPF or DMARC, two SPF records, more than 10 SPF lookups, DKIM keys under 1024 bits.
Warning works today but carries risk: DMARC at p=none, no report address, SPF at 8–10 lookups, a 1024-bit DKIM key, a key in test mode.
Pass means checked and correct.
Note is context, such as a policy inherited from the parent domain.

Each finding links to a guide section that explains why it matters and how to fix it. Where a record is missing, the fix includes a safe starter record you can copy.

DKIM: why "not found" isn't conclusive

DKIM selectors are chosen by each mail platform and can't be listed from DNS. If none of the common selectors match, DKIM may still be working. Open a message from the domain, find s= in its DKIM-Signature header, and enter that selector here. The DKIM guide shows where to look in Gmail and Outlook.

What this check can't see

DNS records show what a domain claims. They don't prove each sending platform signs with your domain, or that its envelope domain aligns with your From: address. For that, read the Authentication-Results header of a real message; DMARC alignment, explained shows how. To test whether a specific IP or range passes SPF, use the SPF validator.

Updated 26 October 2026

Related checks

Email Blacklist Check
Is this mail server's IP blocklisted, and is its reverse DNS set up the way receivers expect?
Email Header Analyzer
Why did this message arrive late, land in spam, or fail authentication?
SPF Validation
Is this IP address, or this whole range, allowed to send mail for the domain?

Guides for this check

DKIM selectors: finding, verifying and rotating keys
What a DKIM selector is, how to find the one your mail platform uses, how to verify the published key, and how to rotate keys without failed signatures.
DMARC alignment, explained: why SPF passes but DMARC fails
Which domains DMARC compares, relaxed vs strict alignment, and how to fix the most common "SPF pass, DMARC fail" and "DKIM pass, DMARC fail" cases.
DMARC from p=none to p=reject without breaking mail
How to move DMARC from monitoring to enforcement: what to publish, which reports to read, how long each stage takes, and what to do with what they find.
Gmail, Yahoo and Microsoft sender requirements, explained
What Gmail, Yahoo and Outlook.com require from senders in 2026: authentication and alignment, reverse DNS, one-click unsubscribe and spam-rate limits.

FAQ

What DMARC policy should I start with?

Begin with p=none and a rua= reporting address so you receive aggregate reports without affecting delivery. Review the reports, tighten to quarantine, then move to reject once all legitimate senders pass.

Why isn't DKIM found?

DKIM selectors are chosen by each mail platform and there's no standard name. If none of the common selectors match, find the selector from a real message's DKIM-Signature header and enter it.

What is the SPF 10-lookup limit?

SPF evaluation can trigger at most 10 DNS-querying terms (include, a, mx, ptr, exists, redirect). Going over this limit causes a permanent error and the SPF check fails.

F1Null MX: this domain says it accepts no email

F1No aggregate report address (rua=)

F2DMARC policy is enforced (p=reject)

F1Selector default: key revoked (empty p=)

F2Selector google: key revoked (empty p=)

F3Selector s1: key revoked (empty p=)

F4Selector s2: key revoked (empty p=)

F5Selector selector1: key revoked (empty p=)

F6Selector selector2: key revoked (empty p=)

F1SPF record is valid (0/10 lookups)