SPF, DKIM &
DMARC checker
The three DNS records that decide whether your email lands in the inbox or in spam - pasted in, taken apart, and explained line by line in plain language. No signup, and nothing you paste leaves your browser.
Each box is optional.
Paste any you can find.
Who is allowed to send email as your domain.
The public key receivers use to verify your signature.
What receivers should do when a message fails the checks.
Want the live records? That takes a terminal
An honest note: a browser page cannot query DNS directly, so this tool reads what you paste. To fetch the real records, open a terminal and run these - then paste the answers above.
Connect your domain to Yetty and the DNS side of your site is guided record by record - verified for you, SSL automatic, health monitored.
Three records decide
if your email is believed
SPF - the guest list
A public list of servers allowed to send email as your domain. Anyone not on it looks suspicious.
DKIM - the wax seal
Each message is cryptographically signed; the public key in DNS lets receivers check the seal is unbroken.
DMARC - the house rules
Your published instruction for mail that fails: let it through, quarantine it, or reject it - plus reports back to you.
The 10-lookup rule
Receivers stop evaluating SPF after 10 DNS lookups. Every include, a, mx and redirect costs one - go over and SPF silently breaks.
~all vs -all
The verdict for unlisted senders: ~all says "be suspicious", -all says "reject". +all says "anyone may impersonate me" - never use it.
Reports (rua)
A rua= address in DMARC gets daily summaries of who is sending as your domain - the only visibility you have into spoofing.
Email DNS questions everyone asks
Why are my emails going to spam?
Usually because receiving servers cannot verify who sent them. Three DNS records fix that: SPF lists the servers allowed to send for your domain, DKIM adds a cryptographic signature, and DMARC tells receivers what to do when a message fails both. Gmail and Yahoo now require all three for anyone sending in volume - a missing or broken record is the most common reason legitimate mail lands in spam.
What does ~all versus -all mean in SPF?
It is the instruction for mail from servers NOT on your list. ~all (softfail) says "treat it with suspicion" - receivers usually let it through but score it down. -all (hardfail) says "reject it outright". Start with ~all while you confirm every legitimate sender is listed, then tighten to -all. +all means "anyone may send as me" and is effectively no protection at all.
Do I need DMARC if I already have SPF and DKIM?
Yes. SPF and DKIM only publish evidence - DMARC is the policy that tells receivers what to do with mail that fails, and it is the only one of the three that stops strangers spoofing your exact from-address. Even a relaxed p=none record is worth having: it switches on aggregate reports, so you can see who is sending as your domain before you tighten the policy.