SPF, DKIM and DMARC Checker
Type a domain. You get its three mail records read from the DNS, with what each one is missing and why it matters.
Why DKIM cannot be listed
SPF and DMARC live at a fixed name, so asking for them is a yes or no. A DKIM signature lives at a name you choose — selector._domainkey.yourdomain — and the DNS has no way to ask “which ones exist”. Every page that tells you “no DKIM found” is telling you it guessed a list and none matched. That is worth knowing before you go and create a second key.
What this does not tell you
Whether your mail actually arrives. These three records say who is allowed to send as you; they say nothing about your reputation, your sending IP or what a spam filter makes of the message itself.
If you are here, this is usually what comes next
The full picture, in one report
This reads three records. Mail Doctor adds the MX, the reverse DNS, the transport TLS and the blacklists, scores it out of ten and puts the fixes in the order that matters.
Frequently asked questions
- It says no DKIM. Do I really not have one?
- Not necessarily, and that is the whole point. Selectors cannot be listed from outside: we try the two dozen that providers commonly use, and plenty of providers use one you would never guess — Google uses a date, for instance. Look in your sending tool for the name, put it in the box, and ask again.
- I have SPF. Why do I need DMARC as well?
- Because SPF alone tells a receiving server that a forged message failed a check, and nothing about what to do next — so most let it through. DMARC is the instruction, and it is also what brings you the reports naming whoever is sending as you.
- Which is worse: no SPF, or an SPF that ends in ~all?
- No SPF, by a distance. A soft ~all still tells receivers who is allowed, and most treat a failure as a strong signal. No record at all means there is nothing to check against, and a forged message looks exactly like yours.