Free SPF, DKIM and DMARC checker for any domain
Enter a domain or an email address. In a few seconds you see whether the domain can receive mail, whether SPF, DKIM and DMARC are set up correctly, and exactly what to change if they are not.
How to use it
- Type your domain (for example
yourcompany.in) or any email address on it, and run the check. - Read each result from MX to TLS-RPT. A pass is fine; a warning works but could be safer; a fail means mail may be rejected, land in junk or be spoofed.
- For each warning or fail, copy the suggested record or change and make it at your DNS host.
- Check again once the record’s TTL has passed (often 5 minutes to an hour) to confirm the fix.
What it checks
- MX: whether the domain can receive email, and which provider handles it.
- SPF: a single valid record, a safe
allending, and the 10 DNS lookup limit counted the way receivers count it. - DKIM: published keys on the selectors used by Microsoft 365, Google Workspace and other common senders.
- DMARC: one record, the enforcement policy, the percentage applied, and whether reports are sent anywhere.
- MTA-STS and TLS-RPT: optional records that force encrypted delivery to your domain.
Guides for fixing what it finds
Questions people ask
Why do my emails go to spam even though SPF passes?
SPF alone is not enough. Gmail, Yahoo and Microsoft also look at DKIM and DMARC, and DMARC needs SPF or DKIM to pass for the same domain that appears in the From address. Run the check above and fix any DKIM or DMARC warnings first.
What does "too many DNS lookups" mean for SPF?
An SPF record may trigger at most 10 DNS lookups, counting every include, a, mx, exists and redirect, including the ones inside included records. Above 10, receivers return a permanent error and SPF fails. Remove services you no longer use or consolidate includes.
Which DMARC policy should I use?
Start with p=none and a rua reporting address so you can see who sends mail as your domain. Once legitimate senders pass SPF or DKIM, move to p=quarantine and then p=reject so spoofed mail is blocked.
Why does the checker say DKIM is missing when I have it?
DKIM keys live under a selector name, and there is no way to list selectors from DNS. The checker tries the common selectors (for example selector1 and selector2 for Microsoft 365, google for Google Workspace). If your provider uses another selector, check it in the provider’s admin settings.
Is my domain stored or logged?
No. The lookups run in your browser against Cloudflare’s public DNS-over-HTTPS resolver. EpiFive does not receive or store the domains you check.