Type the domain you send cold email from. This checker looks up four records in public DNS: SPF (which servers may send as you), DKIM (the signature that proves a message was not changed), DMARC (what receivers do when those checks fail), and MX (where replies go). Each one gets a plain verdict, the record it found, and the fix if something is missing or broken.
Why it matters: since February 2024, Gmail and Yahoo require every sender to set up SPF or DKIM, and bulk senders to set up SPF, DKIM and DMARC. Outlook started rejecting unauthenticated mail from high-volume senders in May 2025. A cold email domain without these records starts every campaign at a disadvantage, however good the copy is.
SPF, DKIM and DMARC checker
Type the domain you send cold email from. The checker looks up its MX, SPF, DKIM and DMARC records in public DNS and tells you what is set up, what is missing, and how to fix it.
Results
Records in place? Compare the tools that keep you in the inbox → Deliverability · Outreach · Email verification · Spam-word checker
Reads public DNS only. It cannot see your sending reputation, your volume, or whether a given message passed. We do not store the domains you check beyond a 10 minute cache.
How it works
- Type a domain such as yourcompany.com, or paste a full email address. Add your DKIM selector if you know it.
- Tap Check domain. Our server looks up the public DNS records; it takes a few seconds.
- Read the verdict (Ready for cold email, Almost there, or Not ready) and the card for each record.
- Copy a plain text report for whoever manages your DNS, or copy a link that reruns the same check.
What it checks
| Record | What gets flagged |
|---|---|
| SPF | No record, more than one record, +all or ?all at the end, more than 10 DNS lookups once nested includes are counted, and includes that point at a domain with no SPF |
| DKIM | No key at 26 common selectors (Google Workspace, Microsoft 365, SendGrid, Mailchimp, Mailgun, Zoho and more) or at the selector you enter, and revoked keys with an empty p= value |
| DMARC | No record, more than one record, a missing or invalid policy, p=none (monitor only), and no rua= address for reports. Subdomains fall back to the parent domain the way receivers do |
| MX | No MX record or a null MX, either of which means replies bounce. It also names the mailbox provider when it can tell |
What it does not do
- It does not test inbox placement or send a test email. It reads DNS only, so it cannot see your sender reputation, volume, or spam complaint rate.
- It cannot prove DKIM is missing. A DKIM key lives under a selector name that cannot be listed from outside, so a custom selector shows as Not found until you enter it.
- It does not keep a history. Results are cached for 10 minutes so repeat checks are fast, then discarded. If you just changed a record, DNS can take a while to update everywhere.
Frequently asked questions
Do I need SPF, DKIM and DMARC to send cold email?
Yes, in practice. Gmail’s sender guidelines ask every sender for SPF or DKIM, and anyone sending 5,000 or more messages a day to Gmail needs all three plus a spam rate under 0.3%. Cold email tools spread sending across mailboxes, but the receiving side still judges the domain. Set up all three before the first campaign.
What is a DKIM selector and where do I find mine?
The selector is the first part of the DKIM record name, the text before ._domainkey. Google Workspace uses google by default and Microsoft 365 uses selector1 and selector2. Other senders pick their own name. You will find it in your provider’s DKIM settings, or in the DKIM-Signature header of an email you sent, after s=.
Is p=none good enough for DMARC?
It meets the Gmail and Yahoo minimum, which is why the checker shows it as Needs attention rather than broken. p=none only asks for reports; it does not stop anyone spoofing your domain. Read the reports for a few weeks, confirm your real mail passes, then move to p=quarantine.
Why does the checker count SPF lookups?
The SPF standard caps a record at 10 DNS lookups, and includes inside includes count too. Past 10, SPF fails for every message. Cold email setups hit this often because each sequencer, CRM and newsletter tool adds its own include. The checker follows the nested includes and gives you the real total.
Should I send cold email from my main domain?
Many teams use a separate domain for outreach so spam complaints do not hurt the domain their invoices and customer email come from. Whatever domain you pick, it needs its own SPF, DKIM, DMARC and MX records, so run each one through this checker.
Do you store the domains I check?
Only for 10 minutes, as a cache of the lookup result, and never with your name or email. There is no account and no sign up. The records the checker reads are public DNS that anyone can look up.
Records in place? Fix the rest of the sending setup with these tools: Deliverability (warmup, inbox placement, mailboxes), Outreach (sequencers), and Email verification (clean lists before you send). Then run your copy through the spam-word checker.