SPF, DMARC and DKIM:
are your emails protected?
Test a domain’s email setup: MX, SPF (10-lookup limit), DMARC, DKIM, MTA-STS, TLS-RPT and BIMI, with a grade and advice to stay out of spam.
Examples: google.com wikipedia.org github.com
Email protections
Three DNS records that stop spoofing of your domain and keep you out of spam.
A “v=spf1 …” TXT record listing allowed servers. Only one per domain, 10 DNS lookups at most.
A public key published under “selector._domainkey”. Your provider signs each message with the private key.
At “_dmarc”: what to do with failing messages (none, quarantine, reject) and where to send reports.
FAQ
What are SPF, DKIM and DMARC for?
SPF lists the servers allowed to send email for your domain. DKIM signs each message to prove it was not altered. DMARC tells receivers what to do when SPF or DKIM fails, and sends you reports. Since 2024, Gmail and Yahoo require them for bulk senders.
What is the SPF 10-lookup limit?
An SPF record may not trigger more than 10 DNS lookups (include, a, mx, redirect…). Beyond that, the check fails and your emails risk going to spam. The tool counts them by following each “include”.
Why can’t the tool find my DKIM key?
The DKIM key is published under a “selector” chosen by your provider, which cannot be guessed for sure. The tool tests the most common ones; otherwise find yours in the “DKIM-Signature: … s=selector” header of a sent email and enter it.