Free tool
Free SPF & DMARC checker
Check a domain's sending authentication, and the mistakes that quietly break it.
How this works
SPF names the servers allowed to send as your domain. DMARC tells receivers what to do when a message fails that check. Together they are what stops anyone spoofing your domain — and what stops your own mail being filtered.
The most common mistake this tool catches is more than one SPF record. Publishing two is not additive: receivers treat it as a permanent error and every SPF check fails, including for mail that would otherwise have passed. It stays invisible until deliverability collapses.
A DMARC policy of p=none monitors and enforces nothing. It is the right place to start and the wrong place to stop — quarantine or reject is where the protection actually lives.
DKIM cannot be checked from a domain name alone. Its record sits at a selector chosen by the sender, so you need the one your mail provider gave you.
Questions, answered.
What is the difference between SPF, DKIM and DMARC?
SPF lists which servers may send as your domain. DKIM cryptographically signs each message. DMARC ties the two to the visible From address and tells receivers what to do when they do not line up.
Can I have two SPF records?
No. Publishing more than one is a permanent error in the specification: receivers fail the check outright rather than combining them, so even mail that would have passed now fails. If you need to authorise more senders, merge them into a single record using include: mechanisms.
What DMARC policy should I use?
Start at p=none to collect reports without affecting delivery, then move to quarantine and finally reject once the reports show your legitimate mail passing. Staying at none indefinitely gives you visibility and no protection.
Why is my mail going to spam even with SPF and DMARC?
Authentication proves who sent a message, not that anyone wants it. Reputation, list hygiene and engagement decide placement. Verifying a list before sending is the fastest lever on the hygiene half.
Does this check DKIM?
Not from the domain alone. A DKIM record lives at a selector chosen by the sender and is not discoverable from DNS, so you need the selector your mail provider gave you — typically something like selector1._domainkey.yourdomain.com.