Free tool
Check a domain's SPF, DKIM, and DMARC in seconds, in plain words, with exactly what to change when something is off.
example.com
A DMARC policy is published, but it asks receiving servers to deliver failing mail anyway.
How to fix: Once the reports show your real senders pass, move the policy to quarantine, then to reject.
One SPF record, 4 of 10 lookups used, ending with a soft fail for servers not listed.
Every check reads only what the site and its public DNS show. Nothing is signed in to, submitted, or attacked.
SPF lists the servers allowed to send as your domain. DKIM signs each message so receivers can tell it was not changed. DMARC tells receivers what to do when a message fails both, and sends you reports about who sends as you.
The most common reasons are a missing or broken SPF, no DKIM signature, and no DMARC policy. Gmail and Yahoo now expect all three from anyone sending in bulk. Content and sending reputation matter too, but authentication comes first.
Start at monitoring (none) with a report address, read the reports for two to four weeks, fix any real sender that fails, then move to quarantine and finally reject.
Ten. Each include, a, mx, exists, and redirect costs a DNS lookup, and so do the ones inside each include. Past ten, SPF fails for part of your mail.
Because copying records by hand is how mistakes happen. We explain what each one means and what to change. MountDev Hosting sets them up for you when your DNS is shared with us.