Free tools

Email domain checker: SPF, DKIM, DMARC and MX

Updated

Short answer

Enter a domain to check its SPF, DKIM, DMARC, MX and BIMI records from public DNS. A domain that sends cold email needs one valid SPF record under 10 DNS lookups, a DKIM key, and a DMARC record; Google, Yahoo and Microsoft require all three from anyone sending 5,000 or more messages a day to their users.

What does each check mean?

RecordWhat it provesPass looks like
MXThe domain can receive mail, so replies and bounces arriveAt least one MX record
SPFWhich servers may send as the domainExactly one v=spf1 record, 10 or fewer DNS lookups, ending in ~all or -all
DKIMThe message was signed by the domain and not changed on the wayA public key at selector._domainkey.domain
DMARCWhat receivers should do when SPF and DKIM fail, and where to send reportsOne v=DMARC1 record at _dmarc.domain with a p= policy and a rua= address
BIMIOptional: shows your logo in supporting inboxesv=BIMI1 at default._bimi.domain, with DMARC at quarantine or reject

What do Google, Yahoo and Microsoft require from senders?

All senders to Gmail need SPF or DKIM, valid forward and reverse DNS, TLS, and a spam rate reported in Postmaster Tools below 0.3%. Bulk senders, meaning 5,000 or more messages a day to Gmail accounts, also need SPF and DKIM and DMARC (at least p=none), a From domain that aligns with SPF or DKIM, and one-click unsubscribe for marketing mail. Yahoo applies the same rules, and Microsoft began enforcing SPF, DKIM and DMARC for Outlook.com senders above 5,000 messages a day in May 2025.

Cold email rarely crosses 5,000 a day from one domain, but filters judge everyone against the same signals. Treat the bulk-sender rules as the minimum for every domain you send from.

Why does SPF fail with too many lookups?

SPF allows at most 10 DNS-querying terms (include, a, mx, ptr, exists and redirect), counted through every nested include. Above 10 the result is a permanent error, which receivers treat as no SPF at all. Every tool you connect tends to add an include. The checker counts them for you; if you are close to 10, remove services you no longer use or move bulk sending to its own subdomain.

How do I fix a failing check?

  • No SPF: add one TXT record at the root, for Google Workspace v=spf1 include:_spf.google.com ~all, plus the include for any other service that sends as you.
  • Two SPF records: merge every include into a single record and delete the other.
  • No DKIM: turn on signing in your mail admin (Google Admin → Gmail → Authenticate email, or Microsoft Defender → DKIM) and publish the key it gives you.
  • No DMARC: start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, read the reports for two to four weeks, then tighten the policy.
  • No MX: point the domain at a mailbox provider so replies to your cold emails are received.

What else matters for cold email deliverability?

Authentication gets you through the door; behaviour keeps you in the inbox. Warm new mailboxes for a few weeks, keep each inbox to a modest daily volume, verify addresses so bounces stay under 2%, and stop sending when replies turn negative. Our guide to AI cold email deliverability covers the limits in detail, and the capacity calculator works out how many domains and mailboxes your volume needs.

Outbound Labs sets this up for you: it sends from separate warmed mailboxes, caps each inbox at 40 emails a day, and pauses a campaign when bounces pass 2%. See pricing or try a free run on your own site.

Frequently asked questions

Is this domain checker free?
Yes. It reads public DNS records only, needs no sign-up, and you can run it as often as you like.
Why does DKIM show a warning when I know it is set up?
DKIM keys live under a selector name that the checker has to guess. It tries the selectors Google Workspace, Microsoft 365 and the common sending tools use. If yours is custom, open a sent email, find s= in the DKIM-Signature header, and enter that selector.
Is p=none good enough for DMARC?
It meets the Google, Yahoo and Microsoft minimum for bulk senders, but it only monitors. Once your reports show every legitimate sender passing, move to quarantine and then reject.
Should I send cold email from my main domain?
No. Send from separate, warmed domains so a bad week of cold email cannot hurt the domain your invoices and customer replies go out from. Each of those domains needs the same SPF, DKIM and DMARC setup.
How long do DNS changes take to show up?
Usually minutes, sometimes up to the record’s TTL, which can be a few hours. Run the check again after you change a record.

Sources

  1. Google: Email sender guidelines
  2. Yahoo: Sender best practices
  3. Microsoft: Outlook requirements for high-volume senders (2025)
  4. dmarcian: Microsoft enforces SPF, DKIM and DMARC (quoting Microsoft’s May 2025 update)
  5. RFC 7208: SPF, DNS lookup limit (section 4.6.4)
  6. RFC 7489: DMARC
  7. BIMI Group: Implementation guide

Related

See the agents work on your own site.

Paste your website and get your ideal customer profile, campaigns and first emails. 750 emails free when your spot opens.

Try a free run →