Tools / Email domain checker
SPF, DKIM & DMARC checker
Enter a domain. See whether its MX, SPF, DKIM and DMARC records are set up right, in plain English, with the fix for anything that is not.
- Up to 5 domains
- No cookies, no account
- Reads public DNS only
We also try 10 common selectors (google, selector1, default...).
Reads public DNS only. Your browser asks Google Public DNS (Cloudflare as backup), not a PennyData server. Free: 30 domains per hour.
- A pass, review or fail verdict for MX, SPF, DKIM and DMARC
- A plain-English reason and the exact fix, next to the raw record
- A copyable report and a CSV
Need this for a long list? Run the bulk version on Apify (paid, PennyData earns a little)
What this tool does, and its limits
The checker reads the public DNS records that decide whether mail from a domain is trusted: MX for where mail is delivered, SPF for which servers may send, DKIM for the signing key and DMARC for what receivers should do when checks fail. Each gets a pass, review or fail verdict in plain English, with the fix when something is off. It only reads public DNS through Google Public DNS and sends no mail. The main limit is DKIM: keys live at a selector name chosen by the sender, so the tool tries ten common ones and a selector you type in, and may report not seen for a domain that signs with another. The bulk version on Apify checks long lists.
Questions
What the records mean
Where email for the domain is delivered.
Which servers are allowed to send as the domain.
A public key receivers use to check a message signature.
What to do when SPF and DKIM fail, plus reports.
What does this email domain checker look at?
It reads the public DNS records that decide whether your email is trusted: MX (where mail is delivered), SPF (which servers may send), DKIM (the signing key, for 10 common selectors plus one you choose) and DMARC (what receivers should do when checks fail). It also notes two optional extras, MTA-STS and BIMI.
Why does it say DKIM was not seen when my email is signed?
DKIM keys live at a selector name that the sender chooses, such as google or selector1, and DNS cannot list all selectors for a domain. The tool tries ten common ones. If your provider uses another, open a real email from your domain, find s= in the DKIM-Signature header, type that into the selector box and check again.
What is the SPF limit of 10 DNS lookups?
SPF allows at most 10 lookups caused by include, a, mx, ptr, exists and redirect, counted through every nested include. Past 10, receivers return a permanent error and SPF fails. The tool follows your includes and shows the count so you can trim before you add another service.
Which DMARC policy should I use?
Start with p=none and an rua address to collect reports without affecting delivery. When the reports show only legitimate senders passing, move to p=quarantine and then p=reject. If you check a subdomain, receivers that find no DMARC record there use the parent domain's policy, so check the parent too.
Do I really need SPF, DKIM and DMARC?
For most domains that send email, yes. Google and Yahoo have required SPF, DKIM and a DMARC policy from bulk senders (about 5,000 or more messages a day to personal Gmail accounts) since February 2024, and smaller senders see better inbox placement with all three.