← All the tools

SPF, DKIM and DMARC checker

Reads the three DNS records that decide whether your mail reaches an inbox, and finds the ones that quietly let anyone send as you or protect nothing at all.

This is one of the checks inside Growth Score

Growth Score runs it with the rest on your live site, scores the result and shows what to fix first.

Test your whole siteOpen in your dashboard

Why it matters

Why this is worth checking

These three records decide whether your email arrives or lands in spam, and two of them are usually set once and never looked at again.

SPF has a hard limit of ten lookups that a growing stack quietly exceeds; DMARC set to p=none reports problems to nobody and enforces nothing.

What it reads

What it looks at

  • SPF: strict ending and lookup count
  • DMARC: enforcing or only watching
  • Where DMARC reports are sent
  • A DKIM key, present and well formed

Reading a result

What a finding means

Each finding says what was seen. This is what it tells you about the page.

SPF over ten lookupsReceivers stop counting at ten, so a growing stack can start to fail.
DMARC set to noneFailures are reported to nobody and nothing is enforced.
No DKIM keyMail carries no signature that proves it came from you.

Common fixes

What to change first

The fixes that come up most, in the order they usually pay off.

Trim the SPF recordRemove senders you no longer use and end the record with a strict rule.
Move DMARC to enforcementAdd a report address, watch the reports, then move to quarantine.
Publish a DKIM keyTurn on signing at your sender and add the key it gives you to DNS.

In Growth Score

Feeds Trust

Whether visitors and browsers have reason to believe you. It reads your security headers, your email authentication records and the trust signals a visitor can see.

It reads the records you paste. Whether they are the ones actually published is a DNS lookup, and whether your mail lands is decided by your sending history as much as by these.

Glossary

Terms behind this check

SPFA DNS record listing the servers that are allowed to send email for your domain.DKIMA digital signature added to each email that proves it was not altered and came from your domain.DMARCA policy that tells receivers what to do with mail that fails SPF and DKIM checks, and reports the results.

Go deeper

Guides that cover it

Your first 100 customersFour zero-spend channels, run one at a time, each read in two weeks.Earn trust on your siteFix the signals software checks, then show the proof a stranger looks for.

FAQ

Questions

Does passing mean inbox delivery?

No. They are the entry requirement. Where mail lands also depends on your sending history and what recipients do with it.

Why paste records, not look them up?

It reads what you paste. Whether those are the records actually published needs a DNS lookup, which this check does not make.

Does the check change my site?

No. It only reads. Nothing is installed, edited or sent to your site by a check.

The other 11

The rest of the checks

Run it with the rest

Growth Score reads your whole site, scores it against sites like yours and ranks what to fix.

Test your whole siteAll the checks

Your Growth Score is 100

Your next fix is waiting in your dashboard.

Open your Growth ScoreOpen dashboard