Email Deliverability Checker
Check whether a domain is set up so its mail reaches inboxes. Reads SPF, DKIM, DMARC and MX, and counts the SPF DNS lookups that quietly break records past ten.
Check SPF, DKIM, DMARC and MX for a domain, including the SPF lookup count that silently breaks records past ten.
Reads public DNS records only. Nothing is sent to the domain and no message is delivered.
Three records decide whether your mail is trusted. SPF lists the servers allowed to send as you, DKIM signs each message so tampering is detectable, and DMARC is the one that tells receivers to actually act on the other two and send you reports.
The check that matters most here is the SPF lookup count. A record is allowed ten DNS-querying terms, every include: expands into that budget, and past ten receivers stop evaluating and return a permanent error. Because the count depends on what your providers put inside their own records, it can cross the line without you changing anything. The whole chain is followed and counted rather than estimated.
About the email deliverability checker
When mail starts landing in spam, the cause is nearly always one of five things: no SPF record, two SPF records where there should be one, an SPF record that has quietly exceeded its DNS lookup budget, DMARC left on p=none so nothing is enforced, or DKIM never switched on. All five are visible in public DNS, which is why this needs nothing from you but a domain name.
The check worth having is the SPF lookup count. A record is allowed ten DNS-querying terms, and every include: expands into that budget recursively. Past ten, receivers stop evaluating and return a permanent error. The unpleasant part is that the count depends on what your providers put inside their own records, so a domain that was fine last month can break without anyone touching it. The whole include chain is followed and counted here rather than estimated.
Only public DNS records are read. Nothing is sent to the domain, no message is delivered, and no mailbox is touched.
How to use it
- 1Enter a domain. An email address works too, since the part after the @ is what gets checked.
- 2Read the problems first: they are sorted with the most serious at the top.
- 3Fix what is marked as a problem, then re-run to confirm.
- 4Use the records panel to see exactly what is published today.
Questions
Why do my emails go to spam?
Most often because one of SPF, DKIM or DMARC is missing or misconfigured, and this tool will name which. The other common causes are outside DNS: a new domain with no sending history, a shared IP with a poor reputation, or content that trips filters. Fix the records first, since they are the part you fully control.
What is the SPF ten lookup limit?
RFC 7208 allows an SPF record ten terms that cause DNS queries: include, a, mx, ptr, exists and redirect. Every include pulls in another record whose own terms count too. Cross ten and receivers return a permanent error, which many treat as a failure. This is the single most common way a working setup breaks by itself.
How do I fix too many SPF lookups?
Remove senders you no longer use, which is usually enough. If it is not, flatten the largest include into explicit ip4 terms, because those do not count against the limit. The catch is that flattened addresses go stale when your provider changes theirs, so it needs reviewing.
Why does it say no DKIM when I know DKIM is set up?
DKIM selectors cannot be discovered. The name is chosen by whoever configured the signing and nothing in DNS lists the selectors in use. Sixteen selectors from the common providers are tried, so a miss means not found under those names rather than no DKIM. Your provider's setup page will name the selector it uses.
Should DMARC be p=none, quarantine or reject?
Start at none, which reports without enforcing, and read the aggregate reports until you are sure all your legitimate mail passes. Then move to quarantine, then reject. Staying at none forever is the common mistake: it gives you data and no protection.
Is -all or ~all better?
-all is stronger and tells receivers to reject anything not listed. ~all is a soft fail and is the right setting while you are still confirming you have listed every sender. Move to -all once you are confident.
Do Google and Yahoo require this?
Yes for bulk senders. Since 2024 both require SPF, DKIM and a DMARC record for anyone sending significant volume to their users, along with one-click unsubscribe and a low complaint rate.
Is any mail sent during the check?
No. Only public DNS records are read. Nothing connects to the domain's mail servers and no message is delivered anywhere.