Email Deliverability & DNS Auth Checker
Audit your domain's SPF, DKIM, DMARC, and MX DNS authentication records to protect sender reputation and prevent spam folder placement.
Email Authentication: SPF, DKIM & DMARC Explained
1. The Three Pillars: SPF, DKIM, DMARC
SPF (Sender Policy Framework) is a DNS TXT record listing which mail servers are authorized to send email for your domain — receiving servers check the sending server's IP against this list. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing messages, verified against a public key published in DNS, proving the message wasn't altered in transit and genuinely came from an authorized sender. DMARC (Domain-based Message Authentication, Reporting and Conformance) sits on top of both — it tells receiving servers what to do when a message fails SPF or DKIM (nothing, quarantine to spam, or reject outright) and can request aggregate reports on authentication failures.
2. How to Use This Checker
Enter a domain (not a full email address or URL) and click “Check Deliverability.” The tool runs live DNS lookups and returns a checklist with pass/fail status for MX, SPF, DMARC, and a DKIM selector probe, plus the raw SPF and DMARC TXT record contents. Use it to confirm records are live after making DNS changes (allow up to a few hours for propagation), or to audit a domain before starting an email marketing or transactional-email campaign from it.
3. Rolling Out DMARC Safely (none → quarantine → reject)
Jumping straight to p=reject on a domain with unmapped legitimate senders (a third-party email marketing tool, a CRM, a helpdesk system) can silently block real mail. The safe rollout path is: start with p=none and a reporting address (rua=mailto:...) to collect aggregate reports without affecting delivery, review those reports over a few weeks to identify every legitimate sending source, add each to your SPF record or set up DKIM signing for it, then move to p=quarantine once confident, and finally p=reject once quarantine shows no unexpected drops.
4. Common Mistakes
A frequent mistake is having more than one SPF TXT record on a domain — the spec requires exactly one, and multiple records cause a permanent SPF failure ("permerror") for all mail. Another is an SPF record that lists too many DNS lookups (the spec caps SPF evaluation at 10 lookups); exceeding this also causes a permerror. A third is publishing a strict DMARC policy before verifying every legitimate sending source is covered, which can silently drop real customer emails, invoices, or password-reset messages sent through third-party tools.
5. Who Should Use This Tool
Developers and marketers setting up a new sending domain, agencies auditing a client's email authentication before a campaign, and anyone diagnosing why legitimate emails are landing in spam folders. It complements — but does not replace — your email service provider's own DKIM setup instructions, since DKIM key generation and signing configuration happens on their side, not in DNS alone.
6. Limitations
The Deliverability Score reflects MX, SPF, and DMARC presence only — it does not currently incorporate the DKIM check result into the numeric score, so review the DKIM checklist row independently rather than assuming a high score means DKIM is configured. DKIM detection itself only probes six common selector names and will report a false negative for any provider using a different selector — this is an inherent limitation of DKIM detection generally, not something a DNS lookup alone can fully solve. This tool also does not check inbox placement, sender reputation scores, or blacklist status — it verifies DNS configuration only, which is a necessary but not sufficient condition for good deliverability.
Frequently Asked Questions
Why are SPF and DMARC records required for high email deliverability?
Major inbox providers (Google Gmail, Yahoo Mail, Microsoft Outlook) enforce mandatory SPF and DMARC authentication to prevent spoofing and phishing. Domains missing these records are automatically routed to spam folders.
What is the recommended DMARC policy for high sender reputation?
Starting with p=none allows you to receive deliverability reports without rejecting emails. Once all legitimate senders are mapped, upgrading to p=quarantine or p=reject ensures total domain protection.
How quickly do DNS record changes take effect for email authentication?
DNS changes typically propagate globally within 15 minutes to 2 hours, depending on your domain registrar's TTL (Time to Live) settings.
Does the Deliverability Score include my DKIM result?
The score is currently calculated from MX, SPF, and DMARC presence only (plus a bonus for an enforcing DMARC policy) — DKIM is checked and shown separately in the checklist below the score, but does not currently factor into the numeric score itself. Treat the score as a summary of your MX/SPF/DMARC posture, and check the DKIM checklist row independently.
Why does this tool say DKIM is missing when I know it's configured?
DKIM selectors (the prefix before `._domainkey` in the DNS record name) are arbitrary strings chosen by whatever service sends your email, and there is no DNS query that can discover an unknown selector directly. This tool probes six commonly-used selector names (google, default, k1, s1, mail, smtp) — if your provider uses a different one, the probe will report DKIM as not found even though it may be correctly configured. This is a known limitation shared by essentially all public DKIM-checking tools, not something specific to this one. Check your email provider's documentation for your exact DKIM selector and verify it directly with a DNS lookup tool if this checker reports a false negative.