Spambil
TR Resellers Log in Start free trial
Free Tool

SPF, DKIM & DMARC check

Look up your domain's email authentication records in real time. See what's missing or misconfigured, and how to fix it. Free, no signup required.

Know your DKIM selector? Enter it here (optional)
If you don't know it, leave this blank and we'll try the most common ones.

Our guide SPF, DKIM and DMARC explained covers what these records do and how to set them up. Want to protect your inbox from spam and phishing? Try Spambil free for 7 days.

What does this tool check?

  • SPF: shows whether your domain has exactly one v=spf1 TXT record, and what it contains. Two separate SPF records is an error.
  • DMARC: reads the record at _dmarc.yourdomain.com and shows its policy (p=none, quarantine or reject).
  • DKIM: DKIM keys are published under a "selector" name that can't be discovered from outside. The tool tries the most common selectors (google, selector1, selector2, default, k1, s1, s2, dkim, mail, smtp), and you can enter your own if you know it.

How to read the results

ResultWhat it meansWhat to do
No SPFTo receivers, it looks like anyone may send mail as you.Build a one-line record with our SPF record generator.
SPF ends in +allAuthorizes the entire internet, which makes the record pointless.Use ~all or -all instead.
DKIM not foundNo key under the common selectors.Enable DKIM in your mail provider's admin panel, or enter your selector and check again.
DMARC p=noneMonitoring only; spoofed mail isn't blocked.Watch the reports for 1–2 weeks, move to quarantine, then to reject.
No DMARCYou don't meet Gmail's and Yahoo's bulk sender requirements.Start with at least v=DMARC1; p=none; rua=mailto:...

Why it matters

Since February 2024, Google and Yahoo have required SPF, DKIM and DMARC together from domains that send more than 5,000 messages a day, and at least SPF or DKIM from smaller senders. Starting in May 2025, Microsoft began applying the same rules to bulk mail sent to Outlook.com addresses. Without these records, your mail lands in spam or gets rejected with errors such as 550 5.7.26. Our SMTP error codes guide explains what each bounce means.

Setting up the records

Most mail providers (Google Workspace, Microsoft 365, Zoho Mail and others) publish the exact SPF include and DKIM key to use in their admin console. The general steps:

  1. SPF: publish a single TXT record on your domain that lists every service that sends mail for you. The SPF record generator builds it for you.
  2. DKIM: turn on DKIM signing in your mail provider and publish the key it gives you as a TXT (or CNAME) record under selector._domainkey.yourcompany.com.
  3. DMARC: add a TXT record at _dmarc.yourcompany.com, starting with p=none and a rua report address, then tighten the policy once the reports look clean.

For the concepts in detail, read SPF, DKIM and DMARC explained. If your mail still goes to spam after that, see why emails go to spam.

Frequently asked questions

I added the record but the tool still can't see it. Why?

DNS changes propagate according to their TTL, usually anywhere from a few minutes to an hour. Make sure you added SPF on the domain itself and DMARC on the _dmarc subdomain, and that any quotation marks are correct.

How do I find my DKIM selector?

Send yourself an email and look at the DKIM-Signature line in its header: the s= value is the selector. You can also paste the header into our email header analyzer to see it.

Do these records block incoming spam?

Not directly. SPF, DKIM and DMARC make it harder for others to impersonate your domain. To stop spam, viruses and phishing sent to you, you need a spam filter that scans your incoming mail.

Related: MX record lookup · Email blacklist check · What is a spam filter?