Mail Check

Audit a domain's mail configuration: MX records, SPF alignment, DKIM selector presence, DMARC policy. Catch common deliverability issues in seconds.

DKIM selector:

About mail check

Mail deliverability depends on three DNS records: MX (where mail is accepted), SPF (which servers may send on your behalf) and DMARC (what to do when SPF or DKIM fails). Mail check pulls all three plus DKIM (if a selector is known) and shows them together so you can see at a glance whether the domain is correctly configured.

What we check

MX records with priority, hostname, resolved IP, ASN and organization.
SPF TXT record. Missing ~all or -all at the end is a common deliverability issue.
DMARC TXT record at _dmarc.domain with policy (none, quarantine, reject).
DKIM at selector._domainkey.domain if you provide a selector (e.g. google for Google Workspace, selector1/selector2 for Microsoft 365).

How it works

Three DNS based mechanisms work together to decide whether a message that claims to come from your domain is legitimate. Mail check reads the DNS records for each of them and evaluates their content. Only DNS queries are made, no mail server is contacted.

SPF (Sender Policy Framework) is a TXT record on the domain that lists which servers may send mail for it. The receiving server compares the IP address of the connecting server with that list. SPF checks the envelope sender (the Return-Path domain), not the visible From address.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The signature names a domain and a selector, and the receiver fetches the public key from selector._domainkey.domain to verify it. Because selectors are free-form, the tool can only find a key if you provide the selector or it is one of the common names that are probed.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is published at _dmarc.domain. It tells receivers what to do when a message fails authentication and requires that the passing SPF or DKIM result is aligned with the domain in the visible From address.

A message passes DMARC if at least one of SPF or DKIM passes and is aligned. This is why having only SPF or only DKIM is a partial setup: DMARC is what ties the technical checks to the address that users actually see.

What the tool evaluates

MX records, including detection of a Null MX (a single MX pointing to a dot, which declares that the domain does not accept mail).
The SPF record, the final all rule, the number of DNS lookups it causes including nested includes, and warnings about risky constructs.
The DMARC record: policy, subdomain policy, percentage, alignment modes and report addresses.
DKIM keys for the selector you enter and for a list of common selectors, with key type, approximate key length, revoked keys and test mode.
Transport and branding records: MTA-STS, TLS-RPT and BIMI.

How to read the results

SPF

An SPF record starts with v=spf1 and then lists mechanisms. Each mechanism can have a qualifier in front of it: + pass (the default if omitted), - fail, ~ softfail and ? neutral.

ip4: and ip6: allow an address or range directly and cost no DNS lookup.
include: pulls in the SPF policy of another domain, typically a mail provider.
a and mx allow the addresses of the domain's A or MX records.
redirect= replaces the policy with that of another domain, and exists: performs a DNS existence test.
The final all mechanism decides the fate of everything not matched earlier. -all rejects, ~all marks as suspicious, ?all gives no verdict and +all allows any server in the world and protects nothing.

The standard allows at most 10 DNS lookups per evaluation, counted across all nested records. The mechanisms include, a, mx, exists, redirect and ptr count. Above 10, the result is a permanent error and receivers may ignore the record, so the tool marks more than 10 lookups as an issue and 8 or 9 as close to the limit.

DMARC

p=none is monitoring only: failing mail is delivered normally and reports are collected.
p=quarantine asks receivers to treat failing mail as suspicious, usually by moving it to spam.
p=reject asks receivers to refuse failing mail during delivery.
sp= sets the policy for subdomains, pct= the share of failing mail to which the policy applies.
adkim= and aspf= select relaxed (r, the default) or strict (s) alignment. Relaxed accepts a subdomain of the same organizational domain, strict requires an exact domain match.
rua= is the address for aggregate reports. Without it you cannot see who sends mail in your name.

DKIM

An RSA key of 2048 bits or more is the common recommendation, and shorter keys are flagged. An empty p= value means the key was revoked. The tag t=y marks test mode, in which receivers are asked to ignore failures.

Examples

A domain with only monitoring

Entering example.com returns an SPF record such as v=spf1 include:_spf.example.net ~all and a DMARC record v=DMARC1; p=none; rua=mailto:dmarc@example.com. Interpretation: SPF allows the included provider and softfails everything else, and DMARC only observes. Spoofed mail from this domain is not blocked yet. Use the aggregate reports to confirm that all legitimate senders pass, then move to quarantine and finally reject.

Too many SPF lookups

A record with many include entries, for instance a mail platform, a ticket system, a newsletter tool and a CRM, can reach 11 lookups once their nested includes are counted. The tool reports the count and lists which record contributes how many. The fix is to remove providers that are no longer used, replace a and mx entries with ip4: ranges where addresses are stable, or move some senders to a subdomain with its own SPF record.

A domain that sends no mail

For a parked domain the recommended records are v=spf1 -all, a DMARC record with p=reject and, if it should not receive mail either, a Null MX.

Common problems and how to fix them

Multiple SPF records: a domain must publish exactly one TXT record starting with v=spf1. Two records cause a permanent error. Merge them into one.
SPF without an all rule: unknown senders are neither allowed nor blocked. End the record with ~all or -all.
No DMARC record: publish a TXT record at _dmarc.example.com, starting with v=DMARC1; p=none; rua=mailto:..., and tighten the policy once reports look clean.
DKIM not found: the selector is probably custom. Look at the DKIM-Signature header of a sent message, read the value of s= and enter it as the selector.
DMARC fails although SPF passes: the SPF result is not aligned. This happens when a third party sends with its own Return-Path domain. Enable DKIM signing with your own domain at that provider.
Forwarded mail fails SPF: forwarding changes the sending IP. DKIM usually survives forwarding, which is why a valid aligned DKIM signature matters.

Questions

What selector should I use?

Common selectors: google (Google Workspace), selector1 and selector2 (Microsoft 365), k1 (Mailgun), mandrill (Mailchimp), mxvault. If your DKIM is set up by a provider, check their docs.

Why is SPF ~all better than -all?

-all is a hard fail, ~all a soft fail. Most modern receivers treat them similarly when DMARC is also present. For new setups use ~all until DMARC reports look clean.

Does the tool query my mail server?

No. Only DNS records are queried (over DoH). No SMTP connection is made to your servers.

What does a DMARC policy of none mean?

p=none is monitoring mode. Receivers deliver mail that fails DMARC normally, but they send aggregate reports to the address in rua if one is set. It is the right starting point, but it does not stop anyone from spoofing your domain.

What is the difference between DMARC quarantine and reject?

With quarantine, failing mail is typically delivered to the spam folder. With reject, receivers refuse it during delivery. Reject gives the strongest protection against spoofing but should be enabled only after reports show that all legitimate senders pass.

What is the SPF limit of 10 DNS lookups?

The SPF standard allows at most 10 DNS lookups while evaluating a record, counted across include, redirect, a, mx, exists and ptr, including nested records. If a record exceeds this, receivers return a permanent error and may ignore SPF. Remove unused includes or use ip4 ranges to get below the limit.

Can a domain have more than one SPF record?

No. A domain must publish only one TXT record that starts with v=spf1. If there are two, evaluation ends in a permanent error. Combine all senders into a single record.

What does DMARC alignment mean?

Alignment requires that the domain authenticated by SPF or DKIM matches the domain in the visible From address. Relaxed alignment accepts subdomains of the same organizational domain, strict alignment needs an exact match. DMARC passes if either SPF or DKIM passes with alignment.

Why does the tool not find my DKIM key?

DKIM keys are stored under a selector chosen by the sender, so there is no way to list them in DNS. The tool probes common selector names and checks the one you enter. Read the s= value from the DKIM-Signature header of a sent message to find your selector.

DNS Lookup

Query A, AAAA, MX, TXT, NS, SOA, CNAME, CAA and SRV records from authoritative resolvers.

DKIM Check

Find a domain's DKIM selectors automatically, or check one you already know.

DNS Propagation

Query a record from probes on five continents at once, with response times and an optional port check.

Email Header Analyzer

Paste raw headers: route with delays, SPF, DKIM, DMARC, likely origin and a plain verdict.