Run a free audit →

Free tool · No account

Free DNS Checker — SPF, DKIM, DMARC.

Your emails are landing in spam and you are not sure which record is to blame. Type your domain. In a few seconds you see whether SPF, DKIM, DMARC, MX and SSL are set up, and what each result means for whether your mail reaches the inbox.

  • SPF record
  • DKIM validation
  • DMARC policy
  • MX records
  • A/AAAA records
  • SSL certificate
🔎 DNS Security Checker

Enter a domain to check every DNS record that decides whether your mail reaches the inbox. Uses Google DNS and Cloudflare DNS-over-HTTPS for accurate, real-time results.

e.g. yourdomain.com — don't include http://
Common: default, selector1, google, s1, dkim

What we check

The four records that decide your inbox rate.

  • SPF

    Tells receivers which IPs are authorised to send for your domain. A missing or broken SPF is a top cause of spam-folder placement.

  • DKIM

    A cryptographic signature proving your emails weren't tampered with in transit. Required for DMARC. Without it, DMARC cannot pass and Gmail treats your mail as unverified.

  • DMARC

    The policy layer telling receivers what to do with emails that fail SPF/DKIM — reject, quarantine, or pass. A missing DMARC leaves your domain unprotected.

  • MX + Routing

    MX records direct inbound mail to the right server. Misconfigured MX records cause bounced replies, broken contact forms, and missed emails.

Understanding your results

What a pass or fail actually means.

The result column above tells you which records exist. This section tells you what each one does to keep your mail out of spam.

  • SPF Sender Policy Framework

    SPF tells receiving servers which IP addresses are allowed to send email for your domain — a whitelist in DNS. When SPF fails, many servers route your email to spam or reject it outright.

    Pass
    Your domain is correctly authorising its sending IPs.
    Fail
    Unknown or unauthorised IPs appear to be sending from your domain. Spoofing risk + spam trigger.
  • DKIM DomainKeys Identified Mail

    DKIM adds a cryptographic signature to outgoing emails. Receivers verify it against your public key in DNS. Mismatch flags the message as tampered or forged.

    Pass
    Email signatures are valid and verifiable. DMARC alignment is possible.
    Fail
    Emails can't be verified. DMARC fails and more of your mail lands in spam.
  • DMARC Domain-based Message Authentication

    DMARC tells receivers what to do with emails that fail SPF or DKIM — reject, quarantine, or let through. It also pipes you reports on who is sending from your domain.

    Pass
    p=reject or p=quarantine: your domain is fully protected against spoofing.
    Fail
    Missing or p=none: your domain has no enforcement. Anyone can spoof your address without consequence.
  • MX Mail Exchange

    MX records define which mail servers receive email for your domain. Without valid MX records, no one can reply to your emails. Multiple records with priority values give redundancy.

    Pass
    Your domain is correctly configured to receive inbound mail.
    Fail
    Missing or invalid: replies to your emails will bounce. Contact forms and transactional replies won't arrive.

Shortlisting tools?

See what a real diagnosis looks like.

Three causes hid behind one Gmail crisis. Read the full walkthrough, then run the same audit on your own domain.

Run a free audit →