SPF, DKIM and DMARC checker
Enter a domain. The checker reads its email authentication records and tells you which ones are missing, which are misconfigured, and what to fix first. No signup.
Records that pass are a start. They do not prove that a form's notification email arrives. Formitor sends a real test lead through each form and checks the inbox.
What the three records do
SPF lists the servers that may send mail for the domain. A receiving server compares the sending server against that list. The record fails when the mail service the site uses is not in it, when the domain has two SPF records, or when the record needs more than 10 DNS lookups.
DKIM lets the sending service sign each message. The public key sits in DNS under a selector name, and the receiver uses it to verify the signature. It fails when a site changes mail service and the new key is never published.
DMARC tells receivers what to do with mail that fails both checks, and where to send reports. Gmail, Yahoo and Microsoft expect a DMARC record on domains that send mail in volume.
How to read the result
- Pass means the record exists and has no problem the checker can see from DNS.
- Warning means the record works but is weaker than it should be, for example a DMARC policy of
p=none. - Fail means the record is missing or broken, and receiving servers are likely to treat the domain's mail as unauthenticated.
If a WordPress site on the domain has stopped delivering form notifications, the records are one of several possible causes. The others are in WordPress not sending emails: 7 causes and how to fix each one.
Checking a whole client portfolio
This page checks one domain at a time, when you remember to run it. If you manage many client sites, see SPF, DKIM and DMARC for WordPress agencies. Formitor runs the same checks for every sending domain in your account and adds the part DNS cannot show: whether a real message landed in the inbox.
Questions about the checker
What does the checker look at?
It reads three DNS records for the domain you enter. SPF: the TXT record that lists which servers may send mail for the domain, including a count of the DNS lookups it needs. DMARC: the policy record at _dmarc.yourdomain. DKIM: the public key records under yourdomain's _domainkey names, for the selector you enter or for a list of common selectors.
Why can the checker not find my DKIM record?
A DKIM record lives under a selector name that the mail service chooses, and DNS has no way to list them. The checker tries selectors that common mail services use. If yours is different, copy the selector from your mail service settings, or from the s= value in the DKIM-Signature header of an email the domain sent, and enter it in the selector field.
What is the SPF 10 lookup limit?
A receiving server will follow at most 10 DNS lookups while it evaluates an SPF record. Every include, a, mx, exists and redirect counts, and so do the lookups inside each included record. Past 10, the check returns a permanent error and SPF fails for every message, even ones sent from a listed server.
Is a DMARC policy of p=none enough?
It satisfies the requirement to have a DMARC record, and it lets you collect reports. It does not tell receivers to do anything with mail that fails. Use it while you confirm that all your legitimate mail passes SPF or DKIM, then move to quarantine or reject.
Does Formitor store the domain I check?
No. The lookup runs in your browser and goes directly to Cloudflare's public DNS resolver. The domain you type is not sent to Formitor.
All three records pass. Why do my form emails still go missing?
DNS records show what should happen. They do not show what happened to a specific message. A form can use the wrong From address, send through a different service than the one in your SPF record, or land in spam for reasons unrelated to authentication. The only way to know is to send a real message and check that it arrives, which is what Formitor does on a schedule.
DNS says what should happen. Formitor checks what did.
Real test leads through every client form, verified at the inbox. Free for 2 sites.