Free tool
Find out why your email goes to spam
Enter a domain and this checks its SPF, DKIM, DMARC and MX configuration — including the SPF lookup limit that breaks authentication silently. Results appear immediately. No signup, no email required.
Reads public DNS only. Nothing is stored, and no email address is required.
What this checks, and why each matters
SPF — who may send as you
Publishes the servers authorised to send mail for your domain. The checker confirms exactly one record exists (two is an instant permerror), counts DNS lookups recursively against the limit of ten, and reports whether the record ends in ~all, -all or the dangerous +all.
DKIM — a signature receivers can verify
A cryptographic signature proving the message was not altered and genuinely came from your domain. Unlike SPF it survives forwarding, which makes it the more reliable of the two. The checker probes around thirty common selectors.
DMARC — the policy that ties it together
Tells receivers what to do when authentication fails, and requests reports so you can see who is sending as you. The checker reads your policy, whether reporting is configured, and whether it applies to all mail or only a percentage.
Alignment — the part most setups miss
DMARC requires that SPF or DKIM not only pass, but pass for a domain matching the From address a recipient sees. A contact form sending as the visitor’s address is the classic failure: everything passes individually, nothing aligns, DMARC fails.
If you want to see how these interact before testing your own domain, the interactive alignment demo lets you toggle each record and watch a receiver’s decision change.
Common questions
Why do my emails go to spam even though I have SPF?+
SPF alone is rarely enough. It authenticates the envelope sender rather than the From address a recipient sees, and it breaks whenever mail is forwarded. Without DKIM, and without a DMARC policy tying either result back to your visible From domain, receivers have little to work with. The most common cause of legitimate mail being filtered is a domain that passes SPF but has no aligned DKIM signature and no DMARC record.
What is the SPF 10-lookup limit?+
RFC 7208 allows an SPF record a maximum of ten DNS lookups when it is evaluated. Every include, a, mx, ptr, exists and redirect mechanism counts, including those nested inside other includes. Exceed ten and receivers return permerror, which means SPF fails entirely. This creeps in gradually as services are added over the years, and it fails silently — nothing bounces, mail just starts being filtered. This tool counts your lookups recursively.
Can you detect DKIM without knowing my selector?+
Not completely. DKIM keys are published at selector._domainkey.yourdomain.com, and selectors cannot be enumerated from outside — there is no way to list them. This checker probes around thirty of the most common selectors used by Google Workspace, Microsoft 365, SendGrid, Mailchimp, Zoho, Postmark, Amazon SES, Hostinger and others. If yours is custom, it may not be found even though DKIM is working correctly.
What DMARC policy should I use?+
Start at p=none with a rua= reporting address, which monitors without affecting delivery. Read the aggregate reports for two to four weeks to find every legitimate sender, fix anything failing alignment, then move to p=quarantine and eventually p=reject. Going straight to reject before you know what is sending on your behalf is how companies accidentally block their own invoices.
Is my data stored?+
No. The check reads public DNS records, returns the result to your browser, and keeps nothing. There is no signup, no email gate, and no logging of the domains checked.
Do I need this if I use Google Workspace or Microsoft 365?+
Yes. Both authenticate mail sent through them, but neither publishes your DMARC policy for you, and neither covers mail sent by other systems on your domain — your website contact form, invoicing software, CRM, marketing platform or e-commerce store. Those are usually the senders that fail.
Who built this
I’m Naeem Safdar, a software engineer working on commerce systems. I built this because I kept diagnosing the same handful of misconfigurations by hand — and because deliverability fails quietly, so nobody goes looking until a customer says they never received something.
I’ve fixed this for clients, including an agency whose authentication was broken across several domains. If your results look bad, it is almost always a configuration fix rather than a rebuild.
Also try the store health check →