SPF, DKIM and DMARC checker: check your domain in ten seconds

Enter your domain and you immediately see whether your SPF record is correct, whether DMARC is set up and with which policy, and whether a DKIM key is published. No sign-up, nothing is stored. Together these three records decide whether Gmail, Outlook and Proximus trust your email.

The checker performs the same DNS lookup a receiving mail server performs. If something is missing, you read below what it means and what to fix first.

Don't know your DKIM selector? Leave the field empty — we try the common selectors of the major platforms.

SPF

    DMARC

      DKIM

        MX

          Is a record missing or is the policy still none? The explainer page shows the order in which to set them up; 2Mail customers set SPF, DKIM and DMARC in one click from the dashboard.

          Set up SPF, DKIM & DMARC Generate a DMARC record About deliverability

          What the three records do

          Each record answers a different question from the receiving server. They complement each other; skipping one weakens the other two.

          SPF

          Which servers may send on behalf of this domain? A list of IP addresses and includes in a TXT record. End with ~all or -all, and stay under ten lookups.

          DKIM

          Did this message stay intact in transit, and does it come from a key of this domain? A digital signature in the mail, with the public key at selector._domainkey.

          DMARC

          What should a receiver do when SPF and DKIM fail, and where does it send reports? A policy (none, quarantine, reject) at _dmarc, with a report address.

          How this checker works

          The tool queries the domain's public DNS records — exactly what every mail server does on receipt. We do not store the domain and do not use the lookup for marketing.

          The checker evaluates the SPF record itself, not the includes behind it; it counts the ten-lookup limit at the first level. For DKIM it tries a series of common selectors; for a platform with its own selector, enter it yourself.

          See 2Mail Help with setup

          Frequently asked questions about the checker

          The tool looks up your domain's SPF record and assesses the all qualifier and the number of lookups, reads the DMARC record at _dmarc and its policy, tries a series of common DKIM selectors (or the one you enter) and shows the MX records. It is the same DNS lookup a receiving mail server performs.
          The selector is the part before ._domainkey in the DNS name of your DKIM key, for example "selector1". Your sending platform or mail suite shows it in the DKIM settings. If you do not know it, leave the field empty: the checker tries the common selectors.
          Your platform then uses a selector that is not in our list. Enter the selector from your platform in the field and check again. If the checker still does not find it, the DNS record has not been created or is incorrect.
          SPF alone is not enough: without DKIM and DMARC your domain remains easy to spoof, and the reputation of your sending IP address and your list quality weigh just as much. Read the deliverability page for the order in which to tackle the rest.
          No. The lookup happens on the spot and the domain is not stored or used for marketing.
          Call us
          Send an email