Check that your domain’s email is set up to prove it’s really from you.
Loading the tool…
The three records
| Record | Where it lives | What it does |
|---|---|---|
| SPF | TXT on your domain | Lists the services allowed to send your email |
| DKIM | TXT at selector._domainkey.yourdomain | Publishes the key that signs your emails |
| DMARC | TXT at _dmarc.yourdomain | Tells inboxes what to do if SPF or DKIM fail, and where to send reports |
Gmail and Yahoo require bulk senders to set up SPF, DKIM and DMARC, and every sender needs at least SPF or DKIM.
Common problems
- Two SPF records: merge them into one.
- More than 10 lookups: SPF allows at most 10 include, a, mx, ptr, exists and redirect terms. Remove services you no longer use.
- DMARC stuck on p=none: it only monitors. Move to quarantine, then reject, once reports look clean.
- Can’t find DKIM: you need the right selector. It’s the s= value in the DKIM-Signature header of an email you’ve sent.
How the check works
Your browser sends the address to our server, which makes the request and sends back the result. We don’t keep the addresses you check. To stop misuse, each visitor can run about 20 checks a minute.
Frequently asked questions
What selector does Google Workspace use?
Usually google, unless you chose another when setting it up.
Is ~all or -all better?
-all is stricter. ~all is common while you check every sender is listed.
Does it send a test email?
No. It reads your public DNS records.
Sources
Last updated: