Draftship
Contact us

Email domain checker

Check a domain's SPF, DKIM, DMARC, MX, BIMI, MTA-STS and blocklist status, with the record to publish for each problem.

An email domain check reads the public DNS records receiving servers use to judge your mail. SPF lists the servers allowed to send for your domain, DKIM publishes the keys that sign it, and DMARC tells receivers what to do when neither passes for your From domain. Google, Yahoo and Microsoft ask bulk senders for all three, and accept DMARC at p=none.

Last verified . The sources named on this page were read that day.

Email domain checker, the tool

Sample report. kestrel-labs.example is a made-up domain

Its records are written to show each kind of finding. Check your own domain above.

  • SPFFailSPF needs 11 DNS lookups and the limit is 10, so receivers return a permanent error and SPF fails.

    Looked up kestrel-labs.example (TXT)

    Record as published

    v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org include:amazonses.com a mx ~all

    Include tree, with the running lookup count

    kestrel-labs.exampleLookups used
    1. include:_spf.google.com1 of 10
      1. 8 address ranges, no lookups; ends in ~all
    2. include:sendgrid.net2 of 10
      1. include:ab.sendgrid.net3 of 10
        1. 4 address ranges, no lookups; ends in ~all
      2. 11 address ranges, no lookups; ends in ~all
    3. include:mailgun.org4 of 10
      1. include:_spf.mailgun.org5 of 10
        1. include:_spf1.mailgun.org6 of 10
          1. 4 address ranges, no lookups; ends in ~all
        2. include:_spf2.mailgun.org7 of 10
          1. 7 address ranges, no lookups; ends in ~all
        3. Ends in ~all
      2. include:_spf.eu.mailgun.org8 of 10
        1. 11 address ranges, no lookups; ends in ~all
      3. Ends in -all
    4. include:amazonses.com9 of 10
      1. 13 address ranges, no lookups; ends in -all
    5. a10 of 10
    6. mx11 of 10 over the limit
    7. ~all

    11 of 10 lookups. Receivers stop at 10 and return a permanent error.

    What each term does

    v=spf1
    Marks this TXT record as SPF version 1.
    include:_spf.google.com
    Also allow the servers in the SPF record of _spf.google.com. Costs a lookup, plus any lookups inside it.
    include:sendgrid.net
    Also allow the servers in the SPF record of sendgrid.net. Costs a lookup, plus any lookups inside it.
    include:mailgun.org
    Also allow the servers in the SPF record of mailgun.org. Costs a lookup, plus any lookups inside it.
    include:amazonses.com
    Also allow the servers in the SPF record of amazonses.com. Costs a lookup, plus any lookups inside it.
    a
    Allow the address records of kestrel-labs.example. Costs a lookup.
    mx
    Allow the mail servers in the MX records of kestrel-labs.example. Costs a lookup.
    ~all
    Softfail every server not listed before it: accept, but mark as suspicious.
    • 11 DNS lookups, counted through every include. SPF allows 10.

    What to do

    Remove includes for services you no longer use, or move a sender onto its own subdomain with its own record. Flattening includes into IP addresses also works, but the list goes stale when a provider changes its addresses.

  • DKIMWarningDKIM key found at google: 1024-bit RSA key. RFC 8301 says signers should use at least 2048 bits.

    Looked up <selector>._domainkey.kestrel-labs.example (TXT)

    google._domainkeyWarning

    1024-bit RSA key. RFC 8301 says signers should use at least 2048 bits.

    v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPi1l/O8QP/cWAUUquimfzlxZgGgSmLY8XDXbAhifAPb155p7B4Hk65KL1eduQlDloJhSx/JEkd9aiDV9Bx1exA/iE9ps624NpQIQfwJO5dMKoOshSciKFeOfW6uL+LtFQLVceB5BfHULdv1YDfArlSg5VaEPNHWbuyHZPj+HOnQIDAQAB

    Tags

    v=DKIM1
    Marks this TXT record as a DKIM key.
    k=rsa
    The key type.
    p=MIGfMA0GCSqGSIb3DQEBAQUA...j+HOnQIDAQAB
    The public key, base64-encoded.
    • The MX records point to Google Workspace. Google Workspace's default selector is google.
    The 41 selectors we tried

    defaultgoogleselector1selector2k1k2k3s1s2m1maildkimsmtpsmtpapimandrillmte1mte2mxvaultmailomxpickrspdk1pdk2pmpostmarksendgridmailgunamazonsessesfdzohozmailbrevofm1fm2fm3protonmailprotonmail2protonmail3sig1

  • DMARCWarningDMARC is at p=none, which makes no request about failing mail. Once reports show all your senders pass, move to quarantine.

    Looked up _dmarc.kestrel-labs.example (TXT)

    Record as published

    v=DMARC1; p=none; rua=mailto:dmarc@kestrel-labs.example

    What each part means

    v=DMARC1
    Marks this TXT record as DMARC.
    p=none
    Policy: no request about mail that fails, which is monitoring only.
    rua=mailto:dmarc@kestrel-labs.example
    Where receivers send aggregate reports.

    Where reports go

    • mailto:dmarc@kestrel-labs.example Same organization, no authorization needed.

    Record to publish

    Host
    _dmarc.kestrel-labs.example
    Type
    TXT
    Value
    v=DMARC1; p=quarantine; rua=mailto:dmarc@kestrel-labs.example

    Publish this only after the reports show every service that sends as you passing SPF or DKIM in alignment.

  • MXPass1 MX host, and it resolves. Mail is hosted by Google Workspace.

    Looked up kestrel-labs.example (MX)

    MX records for kestrel-labs.example, in priority order
    PriorityHostAddresses
    1smtp.google.com64.233.178.2674.125.197.2674.125.197.2764.233.178.272607:f8b0:4020:c07::1a2607:f8b0:4020:c0b::1a2607:f8b0:4020:c0b::1b2607:f8b0:4020:c07::1b

    Recognized from the host names as Google Workspace.

  • BIMINot foundNo BIMI record. BIMI is optional, and it needs DMARC at quarantine or reject before any inbox shows a logo.

    Looked up default._bimi.kestrel-labs.example (TXT)

  • MTA-STSNot foundNo MTA-STS record. It is optional; it tells senders to refuse delivery without verified TLS to your listed MX hosts.

    Looked up _mta-sts.kestrel-labs.example (TXT)

    TLS reporting

    Looked up _smtp._tls.kestrel-labs.example (TXT)

    • No TLS-RPT record at _smtp._tls.kestrel-labs.example, so nobody reports TLS failures to you.
  • BlocklistsCould not checkNot listed on the 14 queries that answered. Spamhaus DBL could not be checked from our server.
    Blocklist results for kestrel-labs.example
    ListCheckedResult
    Spamhaus DBLkestrel-labs.exampleCould not check Spamhaus refused the query from our resolver.
    SURBLkestrel-labs.exampleNot listed
    URIBLkestrel-labs.exampleNot listed
    Spamhaus ZEN64.233.178.26Not listed
    SpamCop64.233.178.26Not listed
    PSBL64.233.178.26Not listed
    Spamhaus ZEN74.125.197.26Not listed
    SpamCop74.125.197.26Not listed
    PSBL74.125.197.26Not listed
    Spamhaus ZEN74.125.197.27Not listed
    SpamCop74.125.197.27Not listed
    PSBL74.125.197.27Not listed
    Spamhaus ZEN64.233.178.27Not listed
    SpamCop64.233.178.27Not listed
    PSBL64.233.178.27Not listed
    • The IP lists are checked against your MX hosts, which receive your mail. The servers that send it can be different and are not visible in DNS.

    What each list means and how to get off it: delisting, list by list.

Against the Gmail, Yahoo and Outlook.com sender rules

  • SPF or DKIM is set upMet

    Google and Yahoo, all senders

    A DKIM key is published.

  • SPF is published and validNot met

    Google, Yahoo and Microsoft, bulk senders

    SPF needs 11 DNS lookups and the limit is 10, so receivers return a permanent error and SPF fails.

  • DKIM is publishedMet

    Google, Yahoo and Microsoft, bulk senders

    A key was found at google._domainkey.

  • DMARC is published (p=none is enough)Met

    Google, Yahoo and Microsoft, bulk senders

    A DMARC record applies, at p=none.

What DNS cannot show

  • Whether the messages you send align: the From domain matching the SPF or DKIM domainGoogle, Yahoo and Microsoft, bulk senders
  • Whether SPF and DKIM pass on the mail you send, not only whether the records existMicrosoft, bulk senders
  • One-click unsubscribe headers and a visible unsubscribe link in marketing mailGoogle and Yahoo, bulk senders
  • Your spam rate, which Google and Yahoo ask to keep under 0.3%Google and Yahoo, all senders
  • Valid forward and reverse DNS for the IP addresses that send your mailGoogle and Yahoo, all senders
  • A TLS connection when your mail is sentGoogle, all senders
  • Message format that follows RFC 5322Google and Yahoo, all senders

What each record does

yourdomain.comMX 10 mx1.yourmailhost.example

MX. Where mail to you is delivered, replies and bounces included. Lower numbers are preferred.

yourdomain.comTXT v=spf1 include:_spf.google.com ~all

SPF. The servers allowed to send for the domain in the envelope sender, within 10 DNS lookups.

selector._domainkey.yourdomain.comTXT v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B…

DKIM. The public key a receiver fetches to check your signature. The sender picks the selector.

_dmarc.yourdomain.comTXT v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

DMARC. What to do with mail that passes neither SPF nor DKIM for your From domain: none, quarantine or reject.

default._bimi.yourdomain.comTXT v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem

BIMI. Your logo, shown only with DMARC at quarantine or reject. Google also asks for a VMC or CMC certificate. Optional.

_mta-sts.yourdomain.comTXT v=STSv1; id=20261018

MTA-STS. Says a policy waits at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, asking senders for TLS to your listed MX hosts. Optional.

_smtp._tls.yourdomain.comTXT v=TLSRPTv1; rua=mailto:tls@yourdomain.com

TLS-RPT. Where senders report TLS failures. Optional.

Sample. One domain’s records, with made-up values. The highlighted part is the label each record sits under.

The order to fix them in

DMARC enforcement comes last, because it acts on whatever SPF and DKIM leave failing. Outlook.com already rejects mail that misses these rules from domains sending it 5,000 or more messages, with error 550 5.7.515.

  1. SPF and DKIM

    One SPF record for every service that sends as you, and DKIM signing turned on at each. Google says to wait 48 hours before adding DMARC.

  2. DMARC at p=none

    With a rua address. Receivers change nothing, and the aggregate reports show everything that sends as your domain.

  3. Fix what the reports show

    Every legitimate stream has to pass before enforcement, which RFC 9989 says may take many months.

  4. Quarantine, then reject

    A domain whose people post to mailing lists should not publish reject (RFC 9989, section 7.4).

  5. BIMI and MTA-STS

    Optional. BIMI needs enforcement first. An MTA-STS policy in enforce mode must list every MX host, or senders that honor it refuse delivery.

What this check can and cannot see

Everything here is public DNS, read when you press the button. It shows what you published, not whether a given message passed; paste a received message into the header analyzer for that. DNS cannot list a domain’s DKIM selectors, so the check tries 41 common ones and any you type. A blocklist that refuses our server shows as could not check, never as clean.

Report addresses on another domain are judged by the last two labels, or three under suffixes such as co.uk, so a rarer suffix can be misjudged. Nothing you check is stored.

HELLOmy name is{first_name}

Nobody replies to {first_name}

We write to the person: a list of companies you can defend, a research note behind each, and every email checked by a person and sent from your own domain.

A person replies within one working day. No newsletter.