SPF, DKIM & DMARC Check for your domain – including MX
This SPF, DKIM and DMARC check tests your domain's email DNS records, including MX, in one go. The tool reads the DNS records, tries common DKIM selectors and explains common issues such as multiple SPF records, ?all, p=none or a missing rua address.
Built by Jakub Martyniak
Free and no sign-up required—just enter a domain and check it.
Running your own mail server? Control DNS records and delivery yourself.
Enter a domain above to check SPF, DMARC, MX, and DKIM.
Example result
What the report looks like in the Email DNS Health Checker
You enter a domain, and the checker looks up SPF, DMARC, MX and DKIM in DNS and lists any detected misconfigurations with explanations. The example uses a fictional domain with intentionally weak records; your results depend on your domain.
Example · Example with fictional domain example.com
Input: domain DNS records
example.com. TXT "v=spf1 include:_spf.google.com ?all"_dmarc.example.com. TXT "v=DMARC1; p=none"example.com. MX 10 mail.example.com.google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…"Output: findings
- 3 warnings
Warning · SPFThis record ends with ?all (neutral), giving receiving mail servers no clear guidance.
Warning · DMARCThe policy is p=none: emails that fail SPF/DKIM/DMARC are still delivered, not blocked or marked.
Warning · DMARCNo rua= reporting address is set, so this domain receives no information about spoofing attempts.
OK · MXMX record found: 10 mail.example.com
OK · DKIMDKIM record found under selector google._domainkey.
How it works
Check SPF, DKIM and DMARC: how it works
Enter a domain, run the check and read the results: see your SPF, DKIM, DMARC and MX results in just a few steps.
Step 1
Enter domain
Enter your domain in the field, for example example.com. You can also paste a URL: the tool automatically removes the protocol, www., path and port.
Step 2
Optional: Enter a DKIM selector
If you know your email provider's DKIM selector, open the DKIM selector field and enter it. It will be checked in addition to the 13 common selectors.
Step 3
Start check
Start the check. SPF, DMARC, MX and the DKIM selectors are queried at the same time.
Step 4
Read result
For each record, you can see whether it was found: the qualifier for SPF, the policy and reporting addresses for DMARC, mail servers ordered by priority for MX, and the selectors found for DKIM. Warnings and explanations appear below; you can expand the raw records if needed.
Step 5
Fix and check again
Correct the records at your DNS provider, then check again. Results may be cached for up to 6 hours, so changes might not appear immediately.
What gets checked
SPF, DKIM, DMARC and MX checks in one go
Instead of using four separate tools, this check queries all four of your domain's email DNS record types at once and displays them together.
SPF check
Looks for the TXT record beginning with v=spf1 on the domain itself and shows the qualifier at the end (-all, ~all, ?all or +all). It warns about multiple SPF records, +all and ?all.
DKIM check
Tries 13 common selectors at selector._domainkey.deinedomain.de: google, selector1, selector2, s1, s2, k1, k2, k3, mta, default, dkim, mail, smtp. You can also enter your own selector.
DMARC checker
Reads the record at _dmarc.deinedomain.de, shows the policy (none, quarantine or reject) and rua reporting addresses, and warns about p=none, a missing or invalid policy, a missing rua address, and multiple DMARC records.
MX record check
Lists the domain's mail servers by priority. Missing MX records are normal if the domain does not receive email. A null MX („.“) is shown as an explicit refusal to receive email.
Common issues
Common SPF and DMARC issues and what they mean
The check detects these misconfigurations and explains them directly in the results, so you know what to change with your DNS provider.
Multiple SPF records
Only one TXT record with v=spf1 is allowed per domain. If there are multiple, mail servers treat this as a permerror, and the SPF check may fail completely. Combine the entries into a single record.
SPF ends with +all
With +all, or an “all” with no qualifier, any server can send email on behalf of your domain. Records commonly end with -all or ~all.
SPF ends with ?all
?all is neutral and gives receiving mail servers no clear guidance on whether to reject mail from an unauthorized server.
Multiple DMARC records
If there are multiple DMARC records at _dmarc, receiving mail servers ignore all of them. Keep only one record.
No valid DMARC policy
If p= is missing or has a value other than none, quarantine or reject, mail servers treat the record as p=none or ignore it entirely.
DMARC policy p=none
p=none is monitoring only: emails that fail the checks are still delivered. Only p=quarantine or p=reject protect against forged senders.
No rua reporting address
Without rua=, you won't receive DMARC reports, leaving you with no insight into spoofing attempts using your domain. The check also warns you if rua= is empty.
Discover more
After the check: more domain and DNS tools
DNS Propagation Checker
Check whether a DNS record has propagated worldwide by querying 20 public resolvers simultaneously.
Built by Jakub Martyniak
Website Security Check
NewCheck a website for known vulnerabilities and outdated software: detect PHP, web server, OpenSSL and CMS versions, compare them with current releases and security advisories, and identify missing security headers. Also includes a self-check for the operating system, databases and pending updates on your own server.
Built by Florian Galz
DNS Lookup
Look up a domain’s A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records, plus Reverse DNS for any IP.
Built by Luca Stanek
WHOIS Lookup
Check a domain's registrar, registration date, expiration date, and nameservers.
Built by Jakub Martyniak
SPF, DKIM & DMARC Generator
NewGenerate SPF, DKIM and DMARC records for sending email from your domain: choose an email provider, configure your own servers and policy, generate a DKIM key in your browser and add everything directly to your ZAP-Hosting domain.
Built by Florian Galz
IP Blacklist Checker
Check whether an IP address or mail server is on spam blacklists (RBL/DNSBL) such as Spamhaus, Barracuda, and SpamCop, including reverse DNS and removal guidance.
Built by Luca Stanek
FAQ
Frequently asked questions about the SPF, DKIM and DMARC check
Brief answers about SPF, DKIM, DMARC, and MX.
The check queries four things through a public DNS resolver (1.1.1.1) at the same time: the SPF record (TXT with v=spf1) on the domain itself, the DMARC record at _dmarc.deinedomain.de, MX records and DKIM under 13 common selectors (google, selector1, selector2, s1, s2, k1, k2, k3, mta, default, dkim, mail, smtp). You can also enter your own DKIM selector. See all the results at a glance.
All three are DNS records that mail servers use to check whether an email really comes from the stated domain. SPF lists authorized sending servers, DKIM digitally signs emails, and DMARC determines what happens to emails that fail these checks.
Enter your domain above and start the check. It shows whether an SPF record with v=spf1 exists, which qualifier it ends with (-all, ~all, ?all or +all), and the full record. It warns you about multiple SPF records, +all or an “all” without a qualifier, since these allow any server to send mail on your behalf, and about ?all, since it is neutral.
DKIM records use a selector chosen by your mail provider, and DNS cannot tell you which selectors exist. The check therefore tries 13 common selectors. If you know yours, enter it in the DKIM selector field. A key with an empty p= is considered revoked and does not count as a match. No match does not necessarily mean DKIM is missing.
A DMARC record is a TXT record at _dmarc.deinedomain.de, for example v=DMARC1; p=quarantine; rua=mailto:dmarc@deinedomain.de. p=none means monitoring only: emails that fail the checks are still delivered. Only p=quarantine (spam folder) or p=reject (rejected) protect against spoofed senders. The check warns you about p=none, a missing or invalid policy, a missing rua address and multiple DMARC records.
Not necessarily. Domains that do not receive email, such as send-only or forwarding domains, do not need MX records. The check shows a null MX („.“, RFC 7505) separately: it means the domain explicitly refuses to receive email.
DNS changes take time to become visible everywhere, and results for a domain may be cached for up to 6 hours. The DNS Propagation Checker shows you whether a new record is visible worldwide yet. If an SPF, DMARC or MX query fails, the check reports an error rather than “not found”, so you don't change a working record unnecessarily. Go to DNS Propagation Checker
The check is free and requires no sign-up: enter a domain, run the check, and you're done. To prevent excessive queries, checks per IP address are limited, and you need to wait a few seconds between checks. After the check, the page URL contains the domain, so you can send the link to your DNS provider, for example.
Any more questions?
Contact SupportRun your own mail server with full control
A ZAP-Hosting VPS gives you full control over your DNS records and email delivery—without relying on a third-party email host.
No setup. No risk. Online in seconds.
Looking for more tools? View all network tools