Email security checker
Check your domain’s SPF, DKIM and DMARC records, and see whether its email is set up to reach inboxes and stop others sending as you. Free, with no sign-up.
SPF, DKIM and DMARC: a plain-English guide
37 Digital’s free email security checker reads your domain’s public DNS and tests the three records that let receiving servers check your email is genuine – SPF, DKIM and DMARC – plus your mail servers. It’s for any business that sends email from its own domain. Gmail, Yahoo and Microsoft now expect these records, and without them your email is more likely to land in spam and easier for others to fake.
What are SPF, DKIM and DMARC?
They’re three DNS records that together let receiving servers check that email from your domain really comes from you.
- SPF (Sender Policy Framework) is a TXT record listing the servers and services allowed to send email as your domain.
- DKIM (DomainKeys Identified Mail) signs each email with a private key and publishes the matching public key in your DNS, so receivers can check it came from you and wasn’t changed on the way.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record asking receivers how to handle email that fails SPF and DKIM – deliver it, send it to spam or refuse it – and where to send you reports.
DMARC passes only when SPF or DKIM passes for a domain that matches the one in the From address, a match called alignment. SPF is defined in RFC 7208, DKIM in RFC 6376 and DMARC in RFC 9989.
| Record | Where it lives in DNS | Example | If it’s missing or fails |
|---|---|---|---|
| SPF | A TXT record on the domain | v=spf1 include:_spf.google.com ~all | Your email is more likely to land in spam |
| DKIM | A TXT record, or a CNAME pointing to one, at selector._domainkey.example.com | v=DKIM1; k=rsa; p=… | Receivers can’t verify your email, and forwarded email often fails DMARC |
| DMARC | A TXT record at _dmarc.example.com | v=DMARC1; p=none; rua=mailto:dmarc@example.com | It’s easier for others to send email pretending to be you |
Reading your results
Results come in four sections – SPF, DKIM, DMARC and mail servers – and each finding is marked:
- Pass – set up correctly.
- Fail – missing or broken, so your email is more likely to be rejected or spoofed.
- Warning – a gap worth closing, or something we couldn’t check this time.
- Note – useful to know. Nothing is broken, though some notes suggest a tidy-up.
DNS can’t list a domain’s DKIM keys, so the checker looks under the names common email services use, such as google for Google Workspace and selector1 and selector2 for Microsoft 365. If yours uses another name, a DKIM warning may not mean anything is wrong – check DKIM in that service’s settings. Amazon SES, Mailgun, HubSpot and Postmark use names we can’t guess, so when we spot one of them we add a Note instead.
Do Gmail, Yahoo and Microsoft require SPF, DKIM and DMARC?
Yes, if you send in bulk – and Gmail and Yahoo ask every sender for at least SPF or DKIM.
- Gmail: since 1 February 2024, everyone sending to Gmail accounts needs SPF or DKIM, and senders of 5,000 or more messages a day need all three, with DMARC of at least
p=none, alignment and one-click unsubscribe on marketing and subscribed email (Google’s email sender guidelines). Google’s FAQ counts mail from your domain and its subdomains together, and once you’re a bulk sender you stay one. Since November 2025, Gmail has stepped up enforcement, so email that falls short can be temporarily or permanently rejected. - Yahoo: since February 2024, all senders need SPF or DKIM. Bulk senders need both, a DMARC policy of at least
p=nonethat their email passes, and one-click unsubscribe on marketing and subscribed email (Yahoo’s sender best practices). - Microsoft: since 5 May 2025, domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses must pass SPF and DKIM and publish DMARC of at least
p=none, aligned with either. Microsoft’s updated announcement says email that doesn’t comply is rejected.
Small senders need them too: the UK’s National Cyber Security Centre (NCSC) recommends these records for every domain an organisation owns in its email security and anti-spoofing guidance.
What changed in DMARC in 2026?
In May 2026, RFC 9989 replaced RFC 7489 as the definition of DMARC. Little changes for most businesses:
- Your existing record still works. It still starts
v=DMARC1, and the main settings are the same. pct,rfandriare retired. Receivers appliedpctinconsistently and may now ignore it, so don’t rely on it to apply your policy to only some email. The other two are harmless, but you can remove them.t=yreplacespctfor testing. It asks receivers to apply one level below your policy, soquarantineis treated asnone, andrejectasquarantine.npis now part of the standard. It sets the policy for subdomains that don’t exist, such as a made-up billing.example.com.
The checker follows RFC 9989, explains t=y and np, and adds a Note for retired tags.
How do I fix SPF, DKIM and DMARC problems?
Start with anything marked Fail, then the warnings – each comes with its own fix.
You make these changes in your domain’s DNS settings, wherever your domain is managed – usually the company you registered it with, such as 123 Reg, GoDaddy or IONOS, or a service like Cloudflare. If you’re not sure, whoever set up your website or email will know.
How do I set up SPF?
Add one TXT record at your domain that starts v=spf1, lists everything that sends email for you and ends ~all or -all. For Microsoft 365 that’s v=spf1 include:spf.protection.outlook.com -all; for Google Workspace, v=spf1 include:_spf.google.com ~all. Add each other service that sends as you, such as your newsletter tool, to the same record.
What is the SPF 10-lookup limit?
SPF allows at most 10 DNS lookups when a receiver checks your record (RFC 7208, section 4.6.4). Each include, a, mx, ptr, exists and redirect counts, and includes can hold more of their own. Past 10, the receiver returns an error, and any server not yet matched fails SPF. The standard also recommends allowing no more than 2 lookups that find nothing, and the checker counts both. To cut lookups, remove services you no longer use, and replace a and mx with the ip4: addresses they stand for.
How do I turn on DKIM in Microsoft 365?
Microsoft 365 doesn’t DKIM-sign email from your own domain until you turn it on. In the Microsoft Defender portal, go to Email & collaboration › Policies & rules › Threat policies › Email authentication settings › DKIM. Select your domain and try to switch it on: Microsoft 365 shows a “Client error” listing the two CNAME records it needs, at selector1._domainkey and selector2._domainkey – that’s expected. Add them exactly as shown, wait a few minutes, then open the domain again and turn on “Sign messages for this domain with DKIM signatures” (Microsoft’s DKIM guide).
How do I turn on DKIM in Google Workspace?
In the Google Admin console, go to Menu › Apps › Google Workspace › Gmail › Authenticate email. Generate a new record (2048-bit if your DNS host allows it), publish it as a TXT record at google._domainkey, then click Start authentication. Google says it can take up to 48 hours to start working.
When should I move DMARC from p=none to p=reject?
When your reports show all your genuine email passing – in stages, not one jump. The DMARC standard warns that p=reject can stop your staff’s emails to mailing lists getting through, and suggests at least a month at p=none and as long at p=quarantine first (RFC 9989, section 7.4). Sign everything with DKIM before you reject, because forwarded email often fails SPF.
| Policy | What it asks receivers to do with email that fails | When to use it |
|---|---|---|
p=none | Deliver it as normal, and send you reports | First, while you find everything that sends as you |
p=quarantine | Treat it as suspicious, usually by putting it in spam | Once reports show your genuine email passing |
p=reject | Refuse it | After a spell at quarantine, with DKIM on everything you send |
How long do DNS changes take to show?
As long as the record’s TTL (time to live): how many seconds DNS servers may keep the old answer before asking again. An hour (3,600 seconds) is common, and some records are set to a day. Until the TTL runs out, this check and the servers receiving your email may still see the old version. For SPF and DMARC, your results show how long that could be.
Common questions
Can I have two SPF records?
No. With two, receivers return an error and SPF fails. Merge them into one record with a single all at the end.
What’s the difference between ~all and -all?
~all (soft fail) says email from servers you haven’t listed is probably not yours; -all (fail) says it isn’t. DMARC counts both as an SPF failure, but Microsoft recommends -all because it says your DMARC policy is effectively ignored for ~all failures on email without a DKIM signature. Google recommends ~all, and the checker accepts both.
Do I need DMARC if I don’t send marketing email?
Yes. DMARC isn’t about marketing: it’s how you ask receivers to stop email that pretends to be from you, such as fake invoices, and its reports show who is sending as you. Start with a p=none record and a report address.
What if my domain doesn’t send email?
Publish v=spf1 -all and v=DMARC1; p=reject. If it receives no email either, add a “null MX” record (0 ., RFC 7505) – the checker then recognises it isn’t used for email and won’t ask for DKIM.
What do you keep when I run a check?
Not your results. The checker only reads public DNS – it never contacts your website or mail servers – and uses only the part of an email address after the @. For 7 days we keep a short log of each check: the tool, the domain, the outcome, how long it took and a code for your connection that changes daily. We never store your IP address, and the counts behind the daily limits are deleted after 48 hours. Cloudflare, which runs the checker and its Turnstile bot check, does process your IP address. Our privacy policy and About our checker have the details.
We set up and monitor SPF, DKIM and DMARC for Microsoft 365 and Google Workspace as part of our email setup and support. Get in touch and we’ll take a look.
More free checks
- Image alt text checker – Find images on a page that screen readers can’t describe, and how to fix them.
- Link preview checker – See how your page will look on Google, LinkedIn and Facebook before you share it, and what to fix.
- All our free tools