Free

Email records checker

Q: How many DNS lookups can an SPF record have?

Ten. Each include, a, mx, ptr, exists and redirect counts, including those inside included records. An SPF record over the limit returns a permanent error and SPF fails. More than two lookups that return nothing also cause a permanent error.

Q: Why can't the checker find my DKIM selector?

DKIM selectors cannot be listed from DNS. With no selector entered, the tool tries 31 common ones. Your provider may use another: it is the s= value in the DKIM-Signature header of a message you sent.

Q: Is DMARC p=none enough?

It is a sensible starting point because it only monitors and blocks nothing. It does not stop spoofing. Once the aggregate reports show your real mail passing, move to quarantine and then reject.

Q: Does this tool send email or contact my mail servers?

No. It reads public DNS records through public resolvers. It never connects to a domain's mail servers and sends no email.

Check a domain's MX, SPF, DKIM and DMARC records in seconds: lookup limits, key strength, policy strength, reporting, and optional MTA-STS, TLS-RPT and BIMI. DNS only, no mail is sent.

Last reviewed October 2026

What does this email records checker test?

It reads four sets of public DNS records that decide whether your mail is delivered and whether others can spoof your domain: MX, SPF, DKIM and DMARC. Gmail and Yahoo have required SPF, DKIM and DMARC from bulk senders since 2024, so missing records now cost you inbox placement.

Record	What it does	What the checker looks for
MX	Says which servers receive mail for the domain.	Records exist, more than one host, every host resolves, no host is a CNAME or a private address. A null MX (RFC 7505) is recognised.
SPF	Lists the servers allowed to send as the domain.	Exactly one `v=spf1` record, a sensible ending (`-all` or `~all`), at most 10 DNS lookups, no loops, bad terms or `ptr`.
DKIM	Publishes the public key that verifies message signatures.	Key present and not revoked, RSA at least 2048 bits (1024 warns), no testing flag (`t=y`). Ed25519 is accepted.
DMARC	Tells receivers what to do when SPF and DKIM fail, and where to send reports.	One record, valid policy, subdomain policy, rollout percentage, report address (`rua`), and whether an outside report domain has authorised it.
MTA-STS, TLS-RPT, BIMI	Optional: force TLS, report TLS failures, show a logo.	Whether the DNS record exists. Missing is shown as info, not a failure.

What do SPF, DKIM and DMARC actually do?

SPF checks the sending server, DKIM checks the message was not altered, and DMARC checks that at least one of them matches the visible From address and says what to do if not.

You need all three. SPF alone breaks when mail is forwarded. DKIM alone does not say what to do with unsigned mail. DMARC ties them together and gives you reports on who is sending as your domain.

How to read your results

SPF: "Too many DNS lookups"

SPF allows ten lookups in total, counting every include, a, mx, exists and redirect and the ones nested inside included records. Over ten, receivers return a permanent error and SPF fails. Remove services you no longer use, or flatten some includes into ip4: ranges. The checker also warns at 9, and when more than two lookups return nothing.

SPF: `~all` or `-all`

Both are fine. -all asks receivers to reject mail from unlisted servers, ~all asks them to treat it as suspicious. With a DMARC policy in place the difference matters little. ?all and +all give no protection.

DMARC: "Policy: none"

Monitoring only. Spoofed mail is still delivered. Collect reports for a few weeks, fix any legitimate senders that fail, then move to p=quarantine and finally p=reject.

DKIM: "No selector found"

DKIM records live at selector._domainkey.yourdomain and DNS cannot list them. The tool tries 31 common selectors (such as google, selector1, default, k1). If yours is not one of them, send yourself a message, open the headers and copy the s= value from the DKIM-Signature line into the selector box.

What this checker does not do

It is DNS only. It does not fetch the MTA-STS policy file, does not connect to your mail servers, does not test whether a message actually passes at a given receiver, and cannot see DKIM keys under selectors it does not know. Queries go to Cloudflare and Google public resolvers, and results are cached for about a minute, so a record you just changed may take a moment to show.

Frequently asked questions

How many DNS lookups can an SPF record have?

Ten. Each include, a, mx, ptr, exists and redirect counts, including those inside included records. Over ten returns a permanent error and SPF fails. More than two lookups that return no records also cause a permanent error.

Why can't the checker find my DKIM selector?

Selectors cannot be listed from DNS. With the field empty, 31 common ones are tried. Yours is the s= value in the DKIM-Signature header of a message you sent.

Is DMARC p=none enough?

It is a good place to start because it blocks nothing while you collect reports. It does not stop spoofing. Move to quarantine and then reject once your real mail passes.

Does this tool send email or contact my mail servers?

No. It reads public DNS records through public resolvers and sends nothing to your domain's servers.

Check your DNS too. Test any DNS server for encryption, DNSSEC, ad filtering and response time. Free, takes seconds.

Check DNS →