Email DNS check: MX, SPF, DKIM and DMARC
Enter a domain to see the DNS records that decide where its mail goes and whether receivers can trust mail sent in its name.
This check reads public DNS only. It doesn't send email or connect to your mail server, and we don't store the domain or IP you enter.
What these records do
Every domain that sends or receives email depends on a few DNS records. They are public, so anyone, including the mail providers that receive your messages, can read them. This check reads them for you and explains what it finds.
MX records say which servers accept mail for the domain. If they are missing or point to an old provider, mail to your addresses goes nowhere or to the wrong place.
SPF is a TXT record that lists the servers allowed to send mail for the domain. A domain should have exactly one SPF record. If you use several services that send in your name, such as a mailbox provider and a newsletter tool, their entries go into that one record. SPF also has a limit of 10 DNS lookups; going over it is a common, silent error.
DKIM adds a signature to each message. The receiving server checks it with a public key published in DNS under a name called a selector. Because each provider picks its own selector, a check like this one can only try common names; not finding a key here doesn't prove you have none.
DMARC ties SPF and DKIM to the address people see in the From line, and tells receivers what to do when a message fails: nothing (none), send it to spam (quarantine) or refuse it (reject). It can also ask receivers to send you reports. Most domains start with none, read the reports, and tighten the policy later.
MTA-STS tells other servers to use an encrypted connection when delivering mail to you. BIMI lets some mail apps show your logo next to your messages; it needs a strict DMARC policy first. Both are optional.
What to fix first
If mail to your domain isn't arriving, start with MX. If your messages land in spam or bounce, check that you have one SPF record that covers every service sending for you, then add DMARC. Large providers such as Gmail, Yahoo and Microsoft now ask bulk senders for SPF, DKIM and DMARC; see our email sender rules pages for the details.
Your mail provider gives you the exact records to add. Copy them as they are, wait for DNS to update (often minutes, sometimes a few hours), and run this check again.
How this check works
We read public DNS records for the domain you enter, the same records any mail server would read. We don't send email, don't connect to your mail server, and don't store what you check.
Questions
Which records does a domain need to receive and send email?
An MX record to receive mail and an SPF record for sending. DKIM and DMARC are optional but improve deliverability, and large providers expect them from bulk senders.
I just changed my DNS. Why does the check show the old records?
DNS changes take time to spread, often minutes and sometimes a few hours. Try again later.
Do you save what I check?
No. Results are shown once and are not stored or indexed.