Reachbox
← All free tools

Free tool

Free SPF, DKIM and DMARC checker

Enter your sending domain to check SPF, DKIM, DMARC and MX at once, and see what to fix in plain words.

Free limit reached

Sign up to keep going

You have used your 3 free checks on this tool. Create a free Reachbox account to keep checking, and let Reachbox write and send your cold email too.

Sign up free

What this checker looks at

  • SPF: the TXT record listing which servers may send mail for your domain, and whether it ends in ~all or -all.
  • DKIM: the public key receivers use to verify your messages were signed by your domain. We try the selectors the big providers use, or the one you enter.
  • DMARC: the policy at _dmarc.yourdomain.com that tells receivers what to do when SPF and DKIM fail, and whether it is p=none, quarantine or reject.
  • MX: whether the domain can receive mail, so replies and bounces have somewhere to go.

Why it matters for cold email

Gmail, Outlook and Yahoo check these records on every message. Since 2024, Google and Yahoo require SPF or DKIM from everyone and DMARC from bulk senders. A missing or broken record is one of the most common reasons cold email lands in spam, and no amount of good copy or warmup makes up for it.

How to fix what it finds

  1. Open the DNS settings wherever your domain is registered or hosted (for example Cloudflare, GoDaddy or Namecheap).
  2. SPF: keep exactly one TXT record starting with v=spf1, include every service that sends for you, and end it with ~all.
  3. DKIM: turn on DKIM signing in your email provider (Google Workspace admin, Microsoft 365 Defender, or your SMTP host) and publish the TXT record it gives you.
  4. DMARC: add a TXT record at _dmarc with v=DMARC1; p=none; and an rua= address for reports. Move to p=quarantine once reports look clean.
  5. Wait for DNS to update (usually minutes, sometimes a few hours) and run the check again.

Missing SPF or DMARC? Build a correct record and copy it into your DNS. SPF record generator →

Start DMARC safely at p=none with a report address. DMARC record generator →

Nothing you enter is stored. The checker only runs public DNS lookups, the same ones any mail server runs when it receives your email.

Questions

  • Why does the checker say no DKIM key was found when DKIM is set up?

    DKIM keys live under a selector chosen by your email provider, and DNS cannot list them. We try the common ones (google, selector1, selector2, default, k1, mail and others). If yours is different, find the s= value in the DKIM-Signature header of an email you sent and enter it as the selector.

  • Should my SPF record end in ~all or -all?

    Both are fine. ~all (soft fail) is the most common choice for cold email because a forwarding or setup mistake does not cause outright rejections. -all is stricter. Avoid ?all and never use +all, which lets anyone send as you.

  • Is DMARC p=none good enough?

    p=none meets the Google and Yahoo bulk sender requirement and lets you collect reports without risking legitimate mail. Once the reports show only your own services sending, moving to p=quarantine adds protection against spoofing.

  • How long do DNS changes take to show up?

    Usually a few minutes, but it can take up to 48 hours depending on your DNS host and the record’s TTL. If a fix does not show yet, wait and run the check again.

  • Do I need these records on a separate domain I use for cold email?

    Yes. Every domain you send from needs its own SPF, DKIM and DMARC records. Many teams send cold email from a separate domain to protect their main one, and that domain needs the full setup too.