What this SPF, DKIM and DMARC test checks
This test queries your domain's public DNS, the way a mail server does when it receives one of your emails. It looks for an SPF record, a DMARC record and a DKIM signature on the most common selectors. Nothing is sent, no mailbox connection is needed and there is no account to create.
The result reads on three levels: well protected, partially protected or vulnerable. Each protocol has its own card showing what was found.
A practical tip: rerun the test after every DNS change, but let propagation finish first. Depending on the provider, it takes from a few minutes to 48 hours.
SPF: the list of servers allowed to send for you
SPF is a TXT record at the root of your domain. It tells receiving servers which servers may send on behalf of your domain. A message coming from a server missing from the list becomes suspect.
Three rules avoid most failures. A domain has a single SPF record: when you add a sending tool, add its include to the existing line instead of creating a second one, otherwise SPF fails. An SPF record is limited to 10 DNS lookups, nested includes counted. Finally, the end of the line matters: ~all (soft fail) flags unknown senders as suspicious, -all (hard fail) asks receivers to reject them.
Example with an OVHcloud mailbox
TXT v=spf1 include:_spf.google.com ~all
DKIM: the signature proving the message comes from you
DKIM adds a cryptographic signature to every email. The receiving server fetches the public key from your DNS, at selector._domainkey.yourdomain. If the signature matches, the message really comes from your domain and was not altered on the way.
The selector is the name your provider gave to the key: google, selector1, a generated name... This test tries the common selectors (default, selector1, selector2, google, k1, k2, k3, mandrill, mailgun, sendgrid, purelymail). Selectors specific to some providers (OVHcloud ones contain an account number, Gandi uses gm1) are not in that list: the result will say "Not detected" even though DKIM may be active. That does not prove it is absent. As for key size, 1024 bits is the minimum and 2048 bits is recommended.
DMARC: what the receiver should do when SPF and DKIM fail
DMARC ties SPF and DKIM to the domain shown in the From field and states what to do on failure. To pass, a message must pass SPF or DKIM with a domain aligned with the From domain. Relaxed alignment accepts a subdomain of the same domain, strict alignment requires the exact same domain.
The p policy has three values: none (observe, block nothing), quarantine (failing messages go to spam) and reject (they are refused). Always add a rua address: you get reports showing who sends on your behalf.
The right method: start with p=none and a reporting address, read the reports for a few weeks, fix legitimate senders that fail, then move to quarantine and finally reject. Jumping straight to reject is the classic way to block your own emails.
Example of a starting DMARC record
TXT _dmarc v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
What Google, Yahoo and Outlook require from senders
Major mailbox providers have tightened their rules. They mostly target high volumes, but some apply to everyone.
- Google (Gmail): since February 2024, every sender needs SPF or DKIM and must keep its spam rate under 0.3% in Postmaster Tools. From 5,000 messages a day to Gmail accounts, you need SPF, DKIM and DMARC, an aligned From domain, one-click unsubscribe for marketing messages and a spam rate under 0.10%. A sender who reaches that threshold once is permanently treated as a bulk sender, and Google has been stepping up enforcement since November 2025, with temporary then permanent rejections.
- Yahoo: SPF and DKIM (1024-bit key minimum), a published DMARC policy of at least p=none, an aligned domain, one-click unsubscribe for marketing and a complaint rate under 0.3%. Yahoo does not publish a volume threshold.
- Outlook.com, Hotmail and Live: since May 5, 2025, domains sending 5,000 messages or more per day must pass SPF and DKIM and publish DMARC. A non-compliant message is rejected with error 550 5.7.515.
In practice: at 50 emails a day you are not a bulk sender, but Google already requires SPF or DKIM from everyone, and DMARC is the sensible minimum. If your volume grows, better to be compliant beforehand.
How to read the test result
- Vulnerable domain: DMARC is missing or in monitoring only (p=none). Nothing then prevents someone from sending emails pretending to be you. Publish SPF and DKIM first, then DMARC at p=none, and tighten afterwards.
- Partial protection: DMARC is at quarantine or reject, but no DKIM signature was detected on the common selectors. Check with your provider whether DKIM is active: it is often a selector the test does not know.
- Well protected domain: DMARC at quarantine or reject and DKIM detected. Watch your DMARC reports and check from time to time that only one SPF record remains.
SPF has its own card: it does not enter the verdict, but a missing or duplicated SPF record still needs fixing.
Set up SPF, DKIM and DMARC with your provider
Menus differ from one provider to the next. Pick yours for the exact paths and values to enter, taken from the official documentation.
Going further
SPF, DKIM and DMARC test: frequently asked questions
How do I test my SPF for free?
Enter your domain in the tool at the top of this page: it reads your SPF record from DNS and tells you whether it exists. You can also display it yourself by querying the domain's TXT records and spotting the line that starts with v=spf1.
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send for your domain. DKIM signs each message to prove its origin and integrity. DMARC ties both to the domain visible in the From field and tells the receiver what to do on failure.
My SPF is valid but my emails go to spam. Why?
SPF alone is not enough. Mailbox providers also look at DKIM, DMARC, alignment with the From domain, the reputation of the domain and IP address, volume and content. A valid SPF is necessary, not sufficient.
How long should I wait after changing DNS?
From a few minutes to 48 hours depending on the provider and the TTL of the previous record. Rerun the test after that delay rather than changing things several times in a row.
Should I set DMARC to reject right away?
No. Start with p=none and a reporting address, read the reports, fix legitimate senders that fail, then move to quarantine and reject. Going straight to reject can get your own emails rejected.
I use several sending tools: how do I handle a single SPF?
Put everything on one line: v=spf1 followed by each service's include, then ~all or -all. Two v=spf1 lines on the same domain make SPF fail, and the total is limited to 10 DNS lookups.
Can the test say DKIM is missing when it is active?
Yes. The test tries common selectors. If your provider uses a different one, it shows "Not detected". Check your provider's interface, or look at the header of a received email: the DKIM-Signature line shows the selector after s=.
Do these rules apply to small senders?
Partly: Google requires SPF or DKIM from every sender to Gmail, and a spam rate under 0.3%. The heaviest requirements (SPF, DKIM and DMARC, one-click unsubscribe) apply from 5,000 messages a day to Gmail.