Email DNS checker

Check a domain's MX, SPF, DKIM and DMARC records in one go. Each check says whether it passes, what's wrong in plain English, and how to fix it.

Domain or email address

You can paste an email address or a web address. We'll use just the domain part.

Your own DKIM selector (optional)

We try common selectors automatically. If yours is different, it's the s= value in the DKIM-Signature header of an email you've sent.

Only the domain name is sent, straight from your browser to Cloudflare's public DNS service (or Google Public DNS if Cloudflare doesn't answer). Nothing is stored.

How this tool works

Your browser looks up the domain's public DNS records using DNS over HTTPS, the same lookups any mail server does when it delivers or checks an email. It then reads the records and checks them against the standards:

MX records say which servers receive email for the domain. We check they exist, that each server name resolves to an address, and recognise common providers such as Microsoft 365 and Google Workspace.
SPF (a TXT record starting v=spf1) lists the servers allowed to send email for the domain. We check there's exactly one, how it ends (-all, ~all, ?all or +all), and follow every include: to count DNS lookups, because SPF fails outright above 10.
DKIM publishes the public key used to sign outgoing email, at selector._domainkey.yourdomain. Selectors can be anything, so we try common ones (Microsoft 365's selector1 and selector2, Google's google, and others) plus any you enter, and report the key size.
DMARC (a TXT record at _dmarc.yourdomain) tells receivers what to do with email that fails SPF and DKIM checks, and where to send reports. We check the policy, the percentage, and the reporting addresses.

DNS changes can take a while to reach every resolver, up to the record's TTL (often an hour). If you've just made a change and it doesn't show yet, try again later.

Tips for reliable email

Have exactly one SPF record. If you use several services (for example Microsoft 365 and a newsletter tool), merge their include: entries into one record rather than adding a second.
Turn on DKIM with your provider. In Microsoft 365 it's in the Defender portal under Email authentication settings; in Google Workspace it's in the Admin console under Gmail, Authenticate email. Then add the records they give you.
Start DMARC at p=none with reports. Read the reports for a few weeks to find every service that sends as you, fix their SPF and DKIM, then move to p=quarantine and finally p=reject.
Lock down domains that never send email. Publish v=spf1 -all, a DMARC record with p=reject, and a null MX (0 .) so nobody can spoof them.
Never use +all. It tells receivers that any server in the world may send as your domain.

Frequently asked questions

What's the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send for your domain. DKIM adds a digital signature to each email so receivers can tell it hasn't been changed and really came from you. DMARC ties them together: it says an email must pass SPF or DKIM for a domain that matches the From address, and tells receivers what to do if it doesn't.

Should SPF end in -all or ~all?

Both are fine once DMARC is in place. -all (fail) is stricter; ~all (soft fail) is the common default from Microsoft and Google and relies on DMARC to decide what happens. Avoid ?all (neutral) and never use +all.

Why does the SPF 10-lookup limit matter?

The SPF standard (RFC 7208) lets a receiver make at most 10 DNS lookups while checking a record, counting every include, a, mx, ptr, exists and redirect, including those inside included records. Go over and SPF returns a permanent error, which usually counts as a fail under DMARC.

Why didn't you find my DKIM record?

DKIM keys live under a selector name that your provider chooses, and there's no way to list them from DNS. We try the common ones. Open an email you sent, view its headers, find DKIM-Signature and enter the s= value as your own selector.

Is p=none bad?

It's a sensible first step, because it gets you reports without affecting delivery. But it doesn't protect anyone: spoofed email using your domain is still delivered. Plan to move to quarantine or reject.

Do you store the domains I check?

No. The lookups go straight from your browser to Cloudflare's public DNS resolver (1.1.1.1), or to Google Public DNS as a fallback. Like any DNS lookup, they see the domain name and your IP address. Nothing passes through our server and nothing is kept.