Email Domain Health
Check SPF, DKIM and DMARC before your email ends up in spam
- SPF and the 10-lookup limit
- DMARC policy
- DKIM with your selector
About Email Domain Health
Enter a domain to check the records that decide whether its email is trusted: SPF (including the 10-lookup limit), the DMARC policy, MX records, MTA-STS, TLS reporting and the optional BIMI record. Add a DKIM selector to check that key as well. A checklist shows which of the large mailbox providers' published sender requirements DNS can confirm and which you need to check elsewhere. Requires a free account.
SPF, DKIM and DMARC in brief
- SPF lists the servers allowed to send email for your domain. It can trigger at most 10 DNS lookups; going over makes it fail.
- DKIM adds a signature to each message, checked against a public key in DNS. Keys live under a selector, so enter yours to check it.
- DMARC tells receivers what to do when SPF or DKIM fails, and where to send reports. A policy of none only monitors.
Mailbox provider requirements
Large mailbox providers such as Gmail and Yahoo require bulk senders to authenticate with SPF and DKIM and to publish a DMARC policy. The results include a checklist of those requirements: items DNS can confirm, such as published SPF and DMARC records, are checked, and items it can’t show, such as spam rates and unsubscribe headers, are marked for you to verify elsewhere. To generate a DMARC record, use the Email Authentication & Deliverability Studio.
What this check can’t see
Authentication is only part of deliverability. Sending reputation, complaint rates, list quality and message content also decide where mail lands, and those aren’t visible in public DNS.
Further reading
Questions people ask
- How do I find my DKIM selector?
- Open the full headers of an email sent from your domain and look for the s= value in the DKIM-Signature header. Your email provider’s documentation lists it too.
- What DMARC policy should I use?
- Start with p=none and a reporting address, fix any legitimate senders that fail, then move to quarantine and finally reject.
- What is MTA-STS?
- A policy that tells other mail servers to deliver to you only over encrypted, verified connections. The check reads your MTA-STS DNS record and fetches the policy file, and also looks for a TLS reporting (TLS-RPT) record.