SPF, DKIM and DMARC checker
The SPF, DKIM and DMARC checker reads live TXT records for one domain: SPF on the domain, DMARC on _dmarc, and DKIM on the selector1 and google selectors. It shows which exist, counts SPF lookup terms against RFC 7208's limit of 10 and reads the DMARC policy. A failed lookup is never reported as a pass.
For domain owners and admins checking why mail lands in spam, or confirming records before Gmail's and Outlook.com's bulk-sender rules apply.
needed
- Price
- Free
- Signup
- None
- Built by
- WebJi®
- Support
- 24/7 email
Last editorial update: 14 November 2026.
How does the SPF, DKIM and DMARC checker inspect a domain?
Enter a bare domain such as example.com; the checker queries four TXT names in live DNS and shows what each returned. A row marked lookup failed means the query itself did not succeed, so it is never reported as present or passed. An empty success means the name answered and the record is missing.
| Check | DNS name | What counts as present |
|---|---|---|
| SPF | the domain | A TXT that starts with v=spf1. Other TXT records are ignored. |
| DMARC | _dmarc.domain | A TXT that starts with v=DMARC1. |
| DKIM | selector1._domainkey.domain | Any TXT on that name. A key-shaped record is noted, not certified. |
| DKIM | google._domainkey.domain | Any TXT on that name. Other selectors are not queried. |
How do you read the SPF count, DKIM status and DMARC policy?
Read SPF as a count of lookup terms written in the record, DKIM as "TXT found" or "no TXT" on two selectors, and DMARC as the p= value: none, quarantine or reject. None of the three rows proves that a real message passes; alignment is not tested.
- SPF number: counts include, a, mx, ptr, exists and redirect written in the top-level record. It does not follow nested includes, and a host name containing "mx" can push the count up by one, so treat it as a hint.
- More than 10: shown as a warning, not as a completed PermError test.
- DKIM: a TXT containing v=DKIM1 or p= is described as key-shaped; anything else on that name is flagged as not a pass.
- DMARC: the policy is read from the p= tag only. Reporting addresses (rua) and percentages are shown in the raw record.
The guide to what DKIM is explains signatures and selectors; DNS records explained covers TXT, MX and the rest.
Why SPF fails with "too many DNS lookups"
RFC 7208, the SPF standard, allows at most 10 DNS-querying terms per evaluation — include, a, mx, ptr, exists and redirect — counted across every nested include; one more returns permerror.
| Term | Counts toward 10? | Note |
|---|---|---|
| include, a, mx, exists | Yes | Each include also adds every lookup inside the included record |
| ptr | Yes | The standard says not to use it |
| redirect= | Yes | A modifier, but it triggers a query |
| ip4, ip6, all | No | No DNS query at evaluation time |
| Void lookups (empty or NXDOMAIN answers) | Separate limit of 2 | Exceeding it also gives permerror |
The same RFC allows only one v=spf1 record per name; two of them is itself a permerror. Because this checker reads only the top-level record, a record showing 6 terms can still exceed 10 once includes such as a mail provider's are expanded.
How to fix a missing SPF, DKIM selector or _dmarc record
Publish one SPF TXT that names only the services that send your mail, turn on DKIM signing at each mail provider, and add a TXT at _dmarc starting with p=none. Then run the check again; a failed lookup is not a fix.
- Merge any duplicate v=spf1 records into a single TXT.
- Remove include, a, mx, ptr, exists and redirect terms for services you no longer send from; use ip4 or ip6 for fixed servers, which cost no lookups.
- Publish the DKIM key your provider shows. Microsoft 365 uses selector1 and selector2 and Google Workspace's default is google; other providers use their own names, which this checker does not query.
- Add
v=DMARC1; p=none; rua=mailto:dmarc@yourdomainat _dmarc, read the reports, then move to quarantine and reject once legitimate mail aligns.
The SPF and DMARC setup guide walks through each record in cPanel, and fixing 550 email errors covers the bounces that follow a bad record.
What Gmail and Outlook.com require from senders
Since 1 February 2024 Gmail requires SPF or DKIM from every sender, and SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day; Outlook.com applied a similar bulk rule from 5 May 2025.
| Rule | Gmail (more than 5,000/day) | Outlook.com, Hotmail, Live (more than 5,000/day) |
|---|---|---|
| SPF and DKIM | Both set up | Both must pass |
| DMARC | Published; p=none is accepted | At least p=none |
| Alignment | From: domain aligned with SPF or DKIM | Aligned with SPF or DKIM, preferably both |
| Unsubscribe | One-click for marketing mail, plus a visible link | Functional, clearly visible link |
| Other | Valid PTR, TLS, spam rate below 0.3% | Valid From/Reply-To, list hygiene |
| Non-compliant mail | May be rejected or marked as spam | Rejected with 550 5.7.515 |
Sources: Google "Email sender guidelines" and Microsoft's Outlook high-volume sender announcement (updated 30 April 2025), both checked 14 November 2026. Gmail also requires DKIM keys of at least 1024 bits and recommends 2048.
Records that exist are not the same as mail that aligns. Send only from hosts named in SPF, sign the visible From: domain with DKIM, and keep bulk campaigns on a separate setup such as email marketing hosting so they cannot damage your office mailboxes on business email hosting.
What to check after SPF, DKIM and DMARC are in place
Check that your MX records point to the right mail host, that the sending IP is not on a blocklist, and that a real test message shows pass for SPF, DKIM and DMARC in its headers.
- MX: the MX record lookup confirms where inbound mail goes.
- Blocklists: the blacklist checker tests the sending IP.
- Headers: send a message to a Gmail or Outlook.com address and open "Show original" or the message source to read the Authentication-Results line.
If a row says lookup failed and you want it read with you, email support@webji.services; the desk answers 24/7 in Hindi and English with an average first reply under 60 minutes.
Frequently asked questions
Why does the checker say lookup failed when my record exists?
The DNS query timed out or returned an error, so the checker could not see the record. It reports that honestly instead of guessing. Run the check again; if it keeps failing, test the name on the DNS lookup tool and check that your nameservers answer.
My DKIM selector is not selector1 or google. How do I check it?
This checker only queries those two names. Find the selector in your mail provider's DKIM settings or in the s= tag of a signed message header, then look up the TXT at selector._domainkey.yourdomain with a DNS lookup tool.
Is p=none enough for Gmail and Outlook.com?
For their bulk-sender rules, yes: both accept p=none as long as messages align with SPF or DKIM. It only monitors, though; it does not stop someone spoofing your domain. Move to quarantine and then reject once reports show all your legitimate mail passing.
Do I need SPF if my mail provider already signs with DKIM?
Publish both. Gmail accepts either for small senders, but its 5,000-a-day rule and Outlook.com's both require SPF and DKIM. DKIM also survives forwarding better than SPF, so having both gives DMARC two chances to pass.
What does the checker send, and can it change my DNS?
It sends only the domain name to WebJi®'s tools endpoint, which runs the four public TXT queries and returns the answers to your browser. It cannot change DNS, send mail or log in to your mail host; edits are made at your DNS provider or hosting panel.
Provider rules and RFC 7208 checked 14 November 2026 · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.