Why do my emails land in spam? Check SPF, DKIM, DMARC.
Type the domain you send email from (the part after @ in the From address) and the tool reads the three DNS records every modern mailbox checks: SPF (which servers may send for you), DKIM (the cryptographic signature on each message) and DMARC (what to do when SPF and DKIM disagree).
You get three traffic-light cards: green means it passes, yellow means it works but is fragile, red means receivers are very likely sending your mail to spam - or rejecting it. Each card opens to show the raw record, the parsed values and a plain-English list of warnings.
We query the records from our server through Cloudflare's public DNS (1.1.1.1). Nothing is written anywhere, the lookup is over in under two seconds.
How to use it
- Type the domain you send from. The From address domain, not the full email. For "marketing@store.com" the domain is store.com. We strip the user part for you if you paste the whole address.
- Hit "Check". The tool fetches SPF, DKIM (for the 8 most common selectors) and DMARC in parallel.
- If a card is green, that piece is healthy. Yellow = it works but has a weak spot worth fixing (testing-mode key, `~all` instead of `-all`, no DMARC reports). Red = receivers may drop your mail.
- Don't see your DKIM key? Turn on "Custom DKIM selectors" and type the selector your email provider uses (e.g. `dkim`, `mxvault`, `mandrill`). The selector is the prefix before `._domainkey.` in the DNS record.
- Read the warnings in each card. They're ordered by impact - fix the top warning first, then re-check.
When this is useful
Five real-world moments where checking SPF/DKIM/DMARC saves you:
- Newsletter going to spam. You set up Mailchimp / Brevo / Klaviyo, sent the first campaign, half the recipients didn't get it. First diagnosis = check SPF + DKIM, the sending platform usually requires both to be aligned.
- Migration to a new email provider. Switching from Google Workspace to Microsoft 365, or adding a transactional sender (Postmark, SendGrid). Old SPF/DKIM stays alongside the new one until propagation finishes - easy to miss.
- "My emails get rejected" complaint from a customer. Customer says "your mail never arrives". Could be: SPF over the 10-lookup limit, DKIM key revoked, DMARC `p=reject` with no `rua` to debug from.
- Phishing protection audit. Your company sends invoices to clients. Without DMARC `p=reject`, anyone can spoof your domain. The tool tells you exactly which piece is missing.
- Pre-launch on a new domain. Before sending the first transactional email from a fresh domain, verify all three pieces are set up. Reputation is built slowly, ruined in one campaign.
For a deep DNS audit beyond email, use the DNS lookup tool. To validate the password on your SMTP account hasn't leaked, see pwned password check.