Check your SPF, DKIM and DMARC in about a minute. We read the public records that decide whether your mail is trusted, give your domain a letter grade, and tell you what is wrong in words you can act on.
The records that decide whether a receiving server trusts your mail.
The three records that prove your mail is really yours. We say which are missing and exactly what to publish.
Every problem comes with the record to copy. No searching for what the syntax should be.
Check your own, or a supplier's before you trust an invoice from them.
Three steps. Nothing to install, and no account.
The address your business sends from. Nothing to install.
A to F, with the reasoning underneath in ordinary language.
Paste the record into your DNS, or hand the page to whoever runs it.
Enter your domain in the box at the top of this page. We read your public DNS records, the same ones a receiving mail server reads, and return a letter grade with each problem written out in plain English. It takes about a minute and needs no account.
The same signals, a different output. The deliverability test gives you a quick read on where you stand. The report card grades the domain A to F and writes the reasoning out underneath, which is the version to run when you want something you can hand to whoever manages your DNS.
An A means SPF, DKIM and DMARC are all published, valid and aligned, and nothing is on a major blocklist. A B usually means one record is weak rather than missing, most often a DMARC policy left at p=none. Anything C or below means at least one thing a receiving server checks is failing.
SPF alone does not get you to the inbox. A receiving server also wants a DKIM signature it can verify and a DMARC policy that tells it what to do when either fails. Reputation matters too: a domain on a blocklist, or one that has just started sending in volume, gets filtered regardless of how correct its records are.
SPF lists which servers are allowed to send as your domain. DKIM adds a signature proving a message was not altered in transit and came from a key you published. DMARC ties the two together, tells receivers what to do with mail that fails, and asks them to report back. You need all three, and DMARC is the one most often missing.
Yes. Every record we read is public DNS, so checking a supplier before you trust an invoice from them is both possible and sensible. We never connect to a mailbox and we never read anyone's inbox.
No. The check on this page is free and unlimited without signing up. An account is only useful if you want your results saved, a history you can re-run, and a daily blocklist check on one domain.
After any change to your mail setup, and then a few times a year. Records drift: a marketing tool gets added to SPF and pushes it past the ten-lookup limit, a provider rotates a DKIM key, or a DMARC policy is loosened to fix a delivery problem and never tightened again.
The check above is yours to run as often as you like without signing up. An account is for when you want yesterday’s answer as well as today’s.
The report card covers all of them at once. These check one thing properly.