What the check looks at
Every server that receives your email looks up public DNS records of your domain to decide whether the message really comes from you. If the records are missing or wrong, mail ends up in spam or gets refused, and anyone can send email that looks like it comes from your address.
MX: who receives your mail
MX records point to the servers that receive email for your domain. From their names we can tell whether your mailbox is on Google Workspace, Microsoft 365, Zoho or your own hosting. MX does not decide whether your sent mail lands in the inbox, but it shows where the setup lives.
SPF: who may send in your name
SPF is one TXT record that starts with v=spf1 and lists every server allowed to send for your domain: your mailbox, newsletter tool, online shop, CRM. The ending tells receivers what to do with all other servers: -all means fail, ~all means treat as suspicious, ?all means no opinion, and +all allows anyone, which you never want.
Receivers stop after 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, together with the ones inside each include. Above 10, SPF returns an error for every message, including your real ones. The check counts them for you, step by step.
DKIM: a signature on every message
DKIM signs each message with a private key. The matching public key is published in DNS under a name called a selector, for example google._domainkey.yourdomain.com. Every service that sends for you has its own selector. There is no way to list all selectors of a domain, so we try the common ones. If yours has another name, enter it in the selector field.
DMARC: what happens to fake mail
DMARC ties SPF and DKIM to the address people see in the From line, tells receivers what to do with mail that fails and where to send reports. p=none only watches, p=quarantine sends failing mail to spam and p=reject refuses it. With rua you get reports about every server that sends mail in your name. The current standard is RFC 9989 from May 2026. It dropped the pct tag and added t=y for a test period.
What Gmail and Yahoo require
Gmail and Yahoo have rules for everyone who sends to their users and stricter rules for bulk senders. Gmail counts you as a bulk sender once you send close to 5,000 messages or more to personal Gmail accounts within 24 hours, and you keep that status. Yahoo does not publish a number. Since November 2025 Gmail has been enforcing the rules more strictly, which includes rejecting mail.
- All senders: SPF or DKIM, valid forward and reverse DNS (PTR) for your sending servers and a spam rate below 0.3%. Gmail also requires a secure TLS connection.
- Bulk senders: both SPF and DKIM, a DMARC record with at least p=none, and a From domain that matches the SPF or DKIM domain.
- Marketing mail from bulk senders: one click unsubscribe in the message headers and a visible unsubscribe link. Gmail asks you to process unsubscribes within 48 hours, Yahoo within two days.
- Spam rate: Gmail says to stay below 0.1% and never reach 0.3% in Postmaster Tools. Yahoo’s limit is also 0.3%.
- Outlook.com, Hotmail and Live.com: Microsoft requires SPF, DKIM and DMARC (at least p=none) from domains that send more than 5,000 messages a day, and since May 2025 it rejects mail that does not meet this.
This tool checks the DNS part: SPF, DKIM and DMARC. Alignment, unsubscribe headers and spam rate only show on real messages and in Postmaster Tools.
Sources: Gmail email sender guidelines, Gmail sender guidelines FAQ, Yahoo Sender Best Practices, Microsoft: Outlook requirements for high volume senders. Checked in October 2026.
How to fix the usual problems
- Two SPF records: merge them into one. Receivers treat two SPF records as an error, so SPF fails for every message.
- Too many lookups: remove services you no longer use and ask the ones you keep whether they offer a shorter include. Be careful with tools that replace includes with IP addresses, because providers change their addresses.
- No DKIM: turn it on in your mailbox admin (Google Workspace, Microsoft 365) and in every tool that sends for you, then add the DNS records they give you.
- No DMARC: start with p=none and an address for reports. Read the reports for a few weeks, add missing senders to SPF and DKIM, then move to quarantine and later to reject.
FAQ
Why does it say no DKIM was found when I have it?
DKIM keys sit under a selector, and selectors cannot be listed from outside. We try the common names. Open an email you sent, choose Show original (Gmail) or View source, and find s= in the DKIM-Signature line. Enter that value as the selector and check again.
Should SPF end with ~all or -all?
Both tell receivers that servers not on the list are not allowed. -all is stricter. If you are not sure that every sender is listed yet, ~all is the safer start, and your DMARC policy decides what finally happens to mail that fails.
Can DMARC block my own email?
Yes, with quarantine or reject, if a service that sends for you is missing from SPF and does not sign with DKIM. That is why you start with p=none, read the reports and only then make the policy stricter.
Do I need this if I do not send newsletters?
Yes. Gmail asks every sender for at least SPF or DKIM, and DMARC protects your domain from people who send fake email in your name, for example fake invoices to your customers.
What is sent and what is stored?
Only the domain name, and only to Google Public DNS, which answers with the public records anyone can look up. We do not store the domain or the results and we never see your emails. Google keeps temporary logs that include your IP address for 24 to 48 hours, as its privacy policy for Public DNS explains.
Rules from RFC 7208 (SPF), RFC 6376 (DKIM), RFC 9989 (DMARC, May 2026, replaces RFC 7489) and RFC 9990 (DMARC reports). Key length advice from Google’s guide Set up DKIM. Checked in October 2026.