SPF, DKIM and DMARC checker
Check whether a sending domain is ready for cold email. We read the live public records, score them out of 100 and tell you exactly what to publish for anything missing.
Enter the domain you send cold email from (not your main website domain, if you use a secondary one). Results appear here with a score, a card per record and the exact fix.
How the score works
| Check | Points | What passes |
|---|---|---|
| MX | 15 | At least one MX record, so replies and bounces reach you |
| SPF | 25 | One v=spf1 record, ends in ~all or -all, includes your provider |
| DKIM | 30 | A public key found at a known or custom selector |
| DMARC | 30 | Record at _dmarc; full points at quarantine or reject, 20 at none |
Records for Google Workspace and Microsoft 365
| Record | Google Workspace | Microsoft 365 |
|---|---|---|
| MX | smtp.google.com (priority 1) | yourdomain-com.mail.protection.outlook.com |
| SPF | v=spf1 include:_spf.google.com ~all | v=spf1 include:spf.protection.outlook.com ~all |
| DKIM | Generate in Admin console, publish at google._domainkey | Enable in Defender, CNAMEs at selector1 and selector2._domainkey |
| DMARC | v=DMARC1; p=none; rua=mailto:[email protected], then move to p=quarantine | |
Sources: Google: set up SPF, Google: set up DKIM, Microsoft: configure DKIM.
The four mistakes we see most
- Two SPF records. Receivers treat two
v=spf1records as a permanent error. Merge them into one. - SPF ending in +all. That authorises the whole internet to send as you. Use
~allor-all. - DKIM never switched on. Google Workspace does not sign mail until you generate the key and click Start authentication.
- No DMARC at all. Since 2024 Gmail and Yahoo expect it from bulk senders, and it is the cheapest trust signal you can add.
Pre-warmed mailboxes from a good provider arrive with all four in place. Getlead publishes and verifies them before warmup starts, so the ramp actually counts.
Questions people ask
How do I check SPF, DKIM and DMARC for a domain?
Enter the domain above. The tool queries public DNS over HTTPS for the MX record, the SPF TXT record on the root, the DMARC TXT record at _dmarc.yourdomain, and DKIM keys at the most common selectors (google, selector1, selector2 and others). Each record is graded and explained.
Why does the checker say DKIM not found when DKIM works?
DKIM keys live at a selector you choose (selector._domainkey.yourdomain.com). We try the common selectors for Google Workspace, Microsoft 365 and popular senders. If you use a custom selector, add it in the selector box and run the check again.
What DMARC policy should a cold email domain use?
Start at p=none with a reporting address while you confirm every legitimate sender passes, then move to p=quarantine. Google and Yahoo require at least p=none for bulk senders since February 2024, and Microsoft applies the same rule to Outlook.com from May 2025.
Is my domain stored when I use this tool?
No. Lookups go straight from your browser to Cloudflare public DNS (cloudflare-dns.com). Nothing is sent to us or saved.