# SPF, DKIM and DMARC checker > Checks a domain's SPF, DKIM and DMARC records against Gmail and Yahoo's sender rules. Free, no signup. We look this up and don't keep it. **SPF, DKIM and DMARC checker. Check a sending domain in seconds, no signup.** Use it at https://tools.joinvalley.co/spf-dkim-dmarc-checker ## What it checks - **An SPF record** (Gmail and Yahoo): Gmail and Yahoo ask every sender to set up SPF or DKIM, and bulk senders to set up both. - **Only one SPF record** (RFC 7208): A domain must not publish more than one SPF record. With two, SPF returns a permanent error. - **SPF within 10 DNS lookups** (RFC 7208): include, a, mx, ptr, exists and redirect each cost a lookup, and so does everything inside an include. Past 10, SPF returns a permanent error. - **Every SPF include works** (Microsoft): An include that doesn't resolve, or points to a domain with no SPF record, makes SPF fail. - **An SPF record that ends in ~all or -all** (RFC 7208, Google, Microsoft): +all lets any server pass as you. ~all and -all tell receivers what to do with servers you didn't list: Google recommends ~all, Microsoft -all. - **No ptr in SPF** (RFC 7208): The SPF standard says the ptr mechanism should not be published. - **A DMARC record** (Gmail and Yahoo): Gmail asks for DMARC from 5,000 messages a day to Gmail accounts, and Yahoo asks its bulk senders. A policy of none is enough. - **Only one DMARC record** (RFC 9989): If a domain publishes more than one DMARC record, receivers discard them all. - **A valid DMARC policy** (RFC 9989): p= is required, and has to be none, quarantine or reject. - **DMARC reports go somewhere** (RFC 9989): rua= is optional, but without it nobody sends you the reports that show who sends as your domain. - **No retired DMARC tags** (RFC 9989): The current DMARC standard removed the pct tag. - **A DKIM key** (Gmail and Yahoo): Bulk senders need DKIM at Gmail and Yahoo. We try the common selectors; give us yours if it's different. - **No revoked DKIM key** (RFC 6376): A DKIM key record with an empty p= means the key has been revoked. - **A 2048-bit DKIM key** (Google): Google says to pick 2048-bit keys if your DNS host supports them, because longer keys are more secure. ## SPF, DKIM and DMARC record examples. What each one looks like, and where it goes. Publish each as a TXT record at your DNS host. Each example says who documents it. ### SPF for Google Workspace **Host:** @ (the domain itself) **Source:** Google's own example for domains that send only through Google Workspace. Google recommends ~all. TXT record: > v=spf1 include:_spf.google.com ~all ### SPF for Microsoft 365 **Host:** @ **Source:** Microsoft's example for domains that send only through Microsoft 365. Microsoft recommends -all, alongside DKIM and DMARC. TXT record: > v=spf1 include:spf.protection.outlook.com -all ### SPF with another sending service **Host:** @ **Note:** One record, every sender in it. Use the include value your service documents; this one is a placeholder. TXT record: > v=spf1 include:_spf.google.com include:_spf.example-sender.com ~all ### SPF for a domain that never sends email **Host:** @ **Source:** Microsoft's record for parked domains: no server may send as this domain. TXT record: > v=spf1 -all ### DMARC to start with **Host:** _dmarc **Note:** p=none asks receivers to take no action, and Gmail and Yahoo accept it. Reports show you who sends as your domain. TXT record: > v=DMARC1; p=none; rua=mailto:dmarc@acme.com ### DMARC that rejects spoofed mail **Host:** _dmarc **Note:** Once the reports show all your real mail passing, reject asks receivers to refuse mail that fails. TXT record: > v=DMARC1; p=reject; rua=mailto:dmarc@acme.com ### DKIM key from Google Workspace **Host:** google._domainkey (google is Google's default selector) **Note:** Google generates the key in the Admin console; you publish it. The key below is shortened. TXT record: > v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA… ## How it works It looks up the domain's SPF, DMARC and MX records, tries the common DKIM selectors (or yours), and follows every SPF include to count DNS lookups. The lookups run on our server through Cloudflare's public DNS resolver; we don't keep the domain or the results. Each check names its source: the SPF, DKIM and DMARC standards (RFC 7208, RFC 6376 and RFC 9989, which replaced RFC 7489), Gmail's and Yahoo's sender requirements, and Google's and Microsoft's setup guides. It can only see DKIM keys at selectors it knows. If yours isn't found, look for s= in the DKIM-Signature header of an email you've sent and check again with it. Records that pass don't guarantee the inbox: complaints, content and how many people you write to matter too. The email spam checker covers the content. ## Sources - [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208) (read 2026-10-15) - [RFC 6376: DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376) (read 2026-10-15) - [RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989) (read 2026-10-15) - [Google's email sender guidelines (Gmail Help)](https://support.google.com/a/answer/81126) (read 2026-10-14) - [Yahoo's sender requirements and recommendations](https://senders.yahooinc.com/best-practices/) (read 2026-10-14) - [Google Workspace Help: Set up SPF](https://knowledge.workspace.google.com/admin/security/set-up-spf) (read 2026-10-15) - [Google Workspace Help: Set up DKIM](https://knowledge.workspace.google.com/admin/security/set-up-dkim) (read 2026-10-15) - [Microsoft Learn: Set up SPF for your Microsoft 365 domain](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure) (read 2026-10-15) - [Microsoft Learn: How to use DKIM for email in your custom domain](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure) (read 2026-10-15) ## Questions people ask ### What is an SPF record? An SPF record is a DNS TXT record, starting v=spf1, that lists the servers allowed to send email for a domain. Receivers check it to see whether a message came from one of them (RFC 7208). ### What is DKIM? DKIM signs each email with a private key, and the domain publishes the matching public key in DNS at {selector}._domainkey.{domain}, so receivers can check the signature (RFC 6376). ### What is DMARC? DMARC is a DNS TXT record at _dmarc.{domain} that tells receivers what to do with mail that fails authentication (none, quarantine or reject) and where to send reports (RFC 9989). ### Do I need SPF, DKIM and DMARC to send cold email? Gmail and Yahoo ask every sender for SPF or DKIM. Send more than 5,000 messages a day to Gmail accounts and Google asks for all three, with a DMARC policy of at least none; Yahoo asks the same of its bulk senders. ### Which DMARC policy should I start with? p=none. Gmail and Yahoo accept it, it asks receivers to take no action, and the reports show who sends as your domain. Move to quarantine or reject once the reports show all your real mail passing; that last part is our view. ### What does 'too many DNS lookups' mean for SPF? SPF allows at most 10 DNS lookups. include, a, mx, ptr, exists and redirect each cost one, and so does everything inside an include. Past 10, SPF fails with a permanent error (RFC 7208). ### Can a domain have two SPF records? No. A domain must not publish more than one SPF record, and with two, SPF returns a permanent error (RFC 7208). Merge every sender into one record. ### Should my SPF record end in ~all or -all? Both are valid. Google recommends ~all for Google Workspace; Microsoft recommends -all for Microsoft 365, alongside DKIM and DMARC. ### How do I find my DKIM selector? Open an email you've sent, view its original headers, and find the DKIM-Signature header: the selector is its s= value (RFC 6376). Google Workspace's default selector is google; Microsoft 365 uses selector1 and selector2. ### Do you keep the domains I check? No. We look the records up through Cloudflare's public DNS resolver and don't store the domain or what we found. ### My records pass. Why do my emails still land in spam? Authentication gets your email considered; complaints and content decide the rest. Check the email itself with the email spam checker, and write to fewer, better-matched people. Valley finds buyers showing real buying signals and messages them across email and LinkedIn. ## Related tools - [Email spam checker](https://tools.joinvalley.co/email-spam-checker): Scores a cold email out of 100 and flags links, money signs, em dashes and merge tags. - [Cold email calculator](https://tools.joinvalley.co/cold-email-calculator): Works back from the meetings you want to the people to contact and emails to send. ## Next step Want replies, not just clean copy? Valley finds buyers showing real buying signals and messages them across email and LinkedIn. [Valley](https://www.joinvalley.co/?utm_source=tools_suite) Shelf: [04 Email outreach](https://tools.joinvalley.co/email-outreach) --- Tools by Valley, made by [Valley](https://www.joinvalley.co/?utm_source=tools_suite). HTML version: https://tools.joinvalley.co/spf-dkim-dmarc-checker