What do SPF, DKIM and DMARC do?
These three DNS records help receiving mail servers decide whether an email really came from your domain. Without them, anyone can send mail that claims to be from you, and your own genuine mail is more likely to land in spam.
SPF lists the servers that may send mail for your domain. DKIM adds a digital signature to each message, which the receiver checks against a public key in your DNS. DMARC tells receivers what to do when SPF and DKIM both fail, and where to send reports.
What is the SPF 10-lookup limit?
An SPF check may trigger at most 10 DNS lookups. Each include, a, mx, ptr, exists and redirect counts as one, and lookups inside included records count too. If you go over, receivers treat the whole SPF record as an error and it stops protecting you. This tool follows your includes and counts the total for you.
How do I find my DKIM selector?
The selector is the name your email provider gives your DKIM key. It appears in the DKIM-Signature header of any email you send, as s=. Google Workspace usually uses google. Microsoft 365 uses selector1 and selector2. If you leave the field blank, this tool tries these and a few other common names.
What DMARC policy should I use?
Start with p=none and a rua address to collect reports. When the reports show that all your legitimate mail passes, move to quarantine, then reject.
Is anything saved?
No. The tool reads public DNS records on demand and shows the result in your browser. Nothing is stored.