Skip to content

Tools is made by Valley.

See how ↗

Tools is made by Valley.

See how ↗

Tools is made by Valley.

See how ↗

Free tool · 04 / SEND

SPF, DKIM and DMARC checker.Check a sending domain in seconds, no signup.

Checks a domain's SPF, DKIM and DMARC records against Gmail and Yahoo's sender rules.

We look this up and don't keep it.

Try or

Use your own DKIM selector

We try google, selector1, selector2 and other common ones. Yours is the s= value in the DKIM-Signature header of an email you've sent.

Type the domain you send email from. We look up its SPF, DKIM, DMARC and MX records and check them against Gmail and Yahoo's sender rules.

Missing a record? Build it here.

SPF record generator

Who sends email for your domain?

Each sending tool documents its own include value. Separate several with commas.

Your SPF record

Type
TXT
Host
@
Value
v=spf1 include:_spf.google.com ~all

1 include at the top level, 1 lookup of 10. Each include can add its own lookups, so check the record above once it's published.

DMARC record generator

Your DMARC record

Type
TXT
Host
_dmarc
Value
v=DMARC1; p=none

Add an address for reports, so you can see who sends as your domain before you tighten the policy.

DKIM keys are made by whoever sends your email: Google Workspace and Microsoft 365 each give you the record to publish. That's why there's no DKIM generator here.

Built by Valley ↗

NEXT STEP

Fed up with perfect records and no replies.Valley finds buyers showing real buying signals and messages them.

Start a 7-day trial ↗

From $149 a seat a month, billed quarterly. 7-day trial, payment method required.

What it checks

14 checks.Each one labelled with where it comes from.

  1. 01Gmail and Yahoo

    An SPF record

    Gmail and Yahoo ask every sender to set up SPF or DKIM, and bulk senders to set up both.

  2. 02RFC 7208

    Only one SPF record

    A domain must not publish more than one SPF record. With two, SPF returns a permanent error.

  3. 03RFC 7208

    SPF within 10 DNS lookups

    include, a, mx, ptr, exists and redirect each cost a lookup, and so does everything inside an include. Past 10, SPF returns a permanent error.

  4. 04Microsoft

    Every SPF include works

    An include that doesn't resolve, or points to a domain with no SPF record, makes SPF fail.

  5. 05RFC 7208, Google, Microsoft

    An SPF record that ends in ~all or -all

    +all lets any server pass as you. ~all and -all tell receivers what to do with servers you didn't list: Google recommends ~all, Microsoft -all.

  6. 06RFC 7208

    No ptr in SPF

    The SPF standard says the ptr mechanism should not be published.

  7. 07Gmail and Yahoo

    A DMARC record

    Gmail asks for DMARC from 5,000 messages a day to Gmail accounts, and Yahoo asks its bulk senders. A policy of none is enough.

  8. 08RFC 9989

    Only one DMARC record

    If a domain publishes more than one DMARC record, receivers discard them all.

  9. 09RFC 9989

    A valid DMARC policy

    p= is required, and has to be none, quarantine or reject.

  10. 10RFC 9989

    DMARC reports go somewhere

    rua= is optional, but without it nobody sends you the reports that show who sends as your domain.

  11. 11RFC 9989

    No retired DMARC tags

    The current DMARC standard removed the pct tag.

  12. 12Gmail and Yahoo

    A DKIM key

    Bulk senders need DKIM at Gmail and Yahoo. We try the common selectors; give us yours if it's different.

  13. 13RFC 6376

    No revoked DKIM key

    A DKIM key record with an empty p= means the key has been revoked.

  14. 14Google

    A 2048-bit DKIM key

    Google says to pick 2048-bit keys if your DNS host supports them, because longer keys are more secure.

Examples

SPF, DKIM and DMARC record examples.What each one looks like, and where it goes.

Publish each as a TXT record at your DNS host. Each example says who documents it.

  1. 01

    SPF for Google Workspace

    Host
    @ (the domain itself)
    Source
    Google's own example for domains that send only through Google Workspace. Google recommends ~all.
    TXT record

    v=spf1 include:_spf.google.com ~all

  2. 02

    SPF for Microsoft 365

    Host
    @
    Source
    Microsoft's example for domains that send only through Microsoft 365. Microsoft recommends -all, alongside DKIM and DMARC.
    TXT record

    v=spf1 include:spf.protection.outlook.com -all

  3. 03

    SPF with another sending service

    Host
    @
    Note
    One record, every sender in it. Use the include value your service documents; this one is a placeholder.
    TXT record

    v=spf1 include:_spf.google.com include:_spf.example-sender.com ~all

  4. 04

    SPF for a domain that never sends email

    Host
    @
    Source
    Microsoft's record for parked domains: no server may send as this domain.
    TXT record

    v=spf1 -all

  5. 05

    DMARC to start with

    Host
    _dmarc
    Note
    p=none asks receivers to take no action, and Gmail and Yahoo accept it. Reports show you who sends as your domain.
    TXT record

    v=DMARC1; p=none; rua=mailto:dmarc@acme.com

  6. 06

    DMARC that rejects spoofed mail

    Host
    _dmarc
    Note
    Once the reports show all your real mail passing, reject asks receivers to refuse mail that fails.
    TXT record

    v=DMARC1; p=reject; rua=mailto:dmarc@acme.com

  7. 07

    DKIM key from Google Workspace

    Host
    google._domainkey (google is Google's default selector)
    Note
    Google generates the key in the Admin console; you publish it. The key below is shortened.
    TXT record

    v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…

How it works

How this tool works.And what it can't see.

It looks up the domain's SPF, DMARC and MX records, tries the common DKIM selectors (or yours), and follows every SPF include to count DNS lookups. The lookups run on our server through Cloudflare's public DNS resolver; we don't keep the domain or the results.

Each check names its source: the SPF, DKIM and DMARC standards (RFC 7208, RFC 6376 and RFC 9989, which replaced RFC 7489), Gmail's and Yahoo's sender requirements, and Google's and Microsoft's setup guides.

It can only see DKIM keys at selectors it knows. If yours isn't found, look for s= in the DKIM-Signature header of an email you've sent and check again with it.

Records that pass don't guarantee the inbox: complaints, content and how many people you write to matter too. The email spam checker covers the content.

Built by Valley.

Sources

Questions

Questions people ask.

What is an SPF record?
An SPF record is a DNS TXT record, starting v=spf1, that lists the servers allowed to send email for a domain. Receivers check it to see whether a message came from one of them (RFC 7208).
What is DKIM?
DKIM signs each email with a private key, and the domain publishes the matching public key in DNS at {selector}._domainkey.{domain}, so receivers can check the signature (RFC 6376).
What is DMARC?
DMARC is a DNS TXT record at _dmarc.{domain} that tells receivers what to do with mail that fails authentication (none, quarantine or reject) and where to send reports (RFC 9989).
Do I need SPF, DKIM and DMARC to send cold email?
Gmail and Yahoo ask every sender for SPF or DKIM. Send more than 5,000 messages a day to Gmail accounts and Google asks for all three, with a DMARC policy of at least none; Yahoo asks the same of its bulk senders.
Which DMARC policy should I start with?
p=none. Gmail and Yahoo accept it, it asks receivers to take no action, and the reports show who sends as your domain. Move to quarantine or reject once the reports show all your real mail passing; that last part is our view.
What does 'too many DNS lookups' mean for SPF?
SPF allows at most 10 DNS lookups. include, a, mx, ptr, exists and redirect each cost one, and so does everything inside an include. Past 10, SPF fails with a permanent error (RFC 7208).
Can a domain have two SPF records?
No. A domain must not publish more than one SPF record, and with two, SPF returns a permanent error (RFC 7208). Merge every sender into one record.
Should my SPF record end in ~all or -all?
Both are valid. Google recommends ~all for Google Workspace; Microsoft recommends -all for Microsoft 365, alongside DKIM and DMARC.
How do I find my DKIM selector?
Open an email you've sent, view its original headers, and find the DKIM-Signature header: the selector is its s= value (RFC 6376). Google Workspace's default selector is google; Microsoft 365 uses selector1 and selector2.
Do you keep the domains I check?
No. We look the records up through Cloudflare's public DNS resolver and don't store the domain or what we found.
My records pass. Why do my emails still land in spam?
Authentication gets your email considered; complaints and content decide the rest. Check the email itself with the email spam checker, and write to fewer, better-matched people. Valley finds buyers showing real buying signals and messages them across email and LinkedIn.

Keep going

Try one of these next.

Valley ↗AI outbound platform: finds, qualifies, researches and messages prospects across LinkedIn and emailMade by us
04 Email outreach →Every tool →