Check a domain’s email configuration

Features

• All four in one go: MX, SPF, DMARC, and DKIM under a selector you supply
• Counts the DNS lookups SPF requires (include / a / mx / ptr / exists / redirect) and warns as you approach the limit of 10
• Explains what the SPF terminator does: `-all` rejects, `~all` lands in spam, `?all` judges nothing, `+all` means no policy at all
• Translates the three DMARC policies into what they actually do: `none` monitors but blocks nothing, `quarantine` sends to spam, `reject` refuses outright
• Splits out the subdomain policy, the percentage applied, aggregate and failure report addresses, and DKIM/SPF alignment
• Flags a missing `p=`, which makes the whole DMARC record invalid
• When a DKIM key is empty, says it is deliberately revoked (RFC 6376) rather than "not configured"
• When SPF or DMARC is absent, states the consequence plainly (anyone can forge mail from the domain)
• Switch between DNS services; falls back automatically when the primary one does not respond

How to use

1. Enter the domain you send mail from (usually the bare domain)
2. Add a DKIM selector if you want that checked; leave it blank if you do not know it
3. Press Check
4. Use the explanation to add whatever is missing at your DNS provider or registrar

FAQ

Why does the SPF row say "in this record" instead of a total?

Because SPF’s limit of 10 lookups is shared across the whole chain: a domain you `include:` adds its own lookups, and so on down the nesting, all inside the same ten. Counting that properly means resolving the entire chain recursively, which is a different order of tool. So this counts only the mechanisms in this record and says so — the number you see is a lower bound; the real total can only be higher.

I know an SPF record is configured, but the tool says it did not come back. Why?

Because the TXT record set at the apex can be large, and resolvers return only part of it. That is not a guess: for the same `cloudflare.com`, Alibaba Cloud returned 0, 17 and 15 records across successive queries while Tencent returned 3, 4 and 4 — and the two services disagreed on the contents. So the tool queries the apex TXT on both DNS services and merges the results, tells you plainly when they disagree, and when no SPF comes back it says only "this query returned none" rather than asserting the domain has no SPF. If you are sure one is configured, switch DNS service or retry shortly.

What happens if SPF exceeds 10 lookups?

It returns `permerror`. What matters is how that behaves: SPF then neither passes nor fails — it is not evaluated at all, so any server can claim to send mail for you while your SPF record still looks perfectly normal. That is why adding "just one more include" is risky: it can silently disable the protection.

I set up DMARC — why do I still receive mail forged from my domain?

Look at the policy row first. If it is `p=none`, DMARC only sends you reports and blocks nothing; real blocking needs `p=quarantine` (spam folder) or `p=reject` (refuse). The usual advice is to watch with `p=none` for a while to make sure nothing legitimate breaks, then tighten it. Also check that the aggregate report address (`rua`) points at a mailbox you actually read — otherwise it is not doing anything for you.

What is a DKIM selector, and which one should I enter?

A selector is the name you chose when you set DKIM up; it publishes a public key under `<selector>._domainkey.<domain>`. A domain can have several at once (for rotation), so you have to say which one. Common ones include `google` (Google Workspace), `selector1` / `selector2` (Microsoft 365) and `s1` / `s2` (SendGrid). Your mail provider’s DNS settings or console will show it.

What does a "revoked" key mean?

It means `p=` in that record is empty. Under RFC 6376 §3.6.1 an empty `p=` is a deliberate, valid value meaning "this key is retired, stop trusting it" — which is what mail providers do when rotating DKIM keys (Google names them by date and leaves an empty record behind). So it is not a misconfiguration and usually needs no action. It does matter if that selector is the one you are currently signing with.