Free SPF, DKIM and DMARC checker
Look up the SPF, DKIM and DMARC records on any domain and see what each one means. Takes about two seconds. No signup, no email address, no result held back.
Records are only half of it
Correct DNS still lands in spam more often than people expect. Inboxrise sends a test message to seed mailboxes and reports where it arrived (inbox or spam) before a campaign goes out.
Start a free trial →What this checker looks at
It reads the public DNS records on your domain. It does not send an email, so it cannot tell you whether your mail reaches the inbox or the spam folder. What it can tell you is whether the three records mailbox providers use to trust a sender are in place.
SPF
SPF is a TXT record on your domain, starting with v=spf1, that lists the servers allowed to send mail for it. The checker finds the record and reads how it ends. ~all or -all tells receivers to flag or refuse mail from servers that are not on the list, and counts as a pass. A record without either lets any server through, so it is marked Check. No record at all is a fail. To look at SPF on its own, with the setup line for common providers, use the SPF record checker.
DKIM
DKIM signs each message with a private key. The matching public key sits in DNS under a name called a selector, and receivers use it to confirm the message really came from your domain and was not changed on the way. DNS does not list a domain's selectors, so the checker tries the common ones used by Google Workspace, Microsoft 365, Zoho, Hostinger and other providers. If none of them answer, the result is Check rather than Fail, because your key may sit under a custom selector. A key with an empty p= value has been revoked, and that is a fail.
DMARC
DMARC is a TXT record at _dmarc.yourdomain.com that tells receivers what to do with mail that fails SPF and DKIM for your domain. p=quarantine or p=reject is an enforced policy and passes. p=none only monitors, so it is marked Check. No record is a fail. To look at DMARC on its own, with how to add a record and when to tighten it, use the DMARC record checker.
What to do with the result
A missing record does not stop mail from going out, but it gives mailbox providers a reason to distrust it, and Google and Yahoo now ask bulk senders to have all three in place. Fix anything marked Fail first, then the Check items. DNS changes can take a few hours to show up, so run the check again after you edit a record.
Passing all three is the baseline, not a guarantee: providers also weigh your sending history, bounces and complaints. For step-by-step setup, read how to set up SPF and DKIM, plus DMARC.