DMARC checker, plus SPF, DKIM and MX
Enter a domain to see whether it can receive email and whether it is set up to prove its emails are genuine. Gmail, Yahoo and Outlook.com require these records from bulk senders.
What each record does
| Record | What it does | Where it lives |
|---|---|---|
| MX | Tells the world which server receives your email | Your domain |
| SPF | Lists the servers allowed to send email for your domain | A TXT record starting v=spf1 |
| DKIM | A digital signature that proves an email was not changed and came from you | A TXT record at selector._domainkey.yourdomain |
| DMARC | Tells receivers what to do with mail that fails SPF and DKIM, and where to send reports | A TXT record at _dmarc.yourdomain |
What the big mailbox providers require
Since February 2024, Gmail (for senders of more than 5,000 messages a day) and Yahoo (for bulk senders) require SPF, DKIM and a DMARC record of at least p=none, with the From domain aligned. Microsoft added similar rules for Outlook.com, Hotmail and Live in May 2025. Smaller senders benefit too: these records are one of the main things that keep real mail out of spam.
Common problems this tool finds
- Two SPF records. Only one is allowed; with two, SPF fails. Merge them.
+allin SPF. This lets anyone send as you. Use~allor-all.- Too many SPF lookups. SPF allows 10 DNS lookups in total. Each
include:counts, plus any lookups inside it. - No DMARC record. Add
v=DMARC1; p=none; rua=mailto:you@yourdomainto start monitoring. - DKIM not found. Turn on DKIM signing in your email provider and publish the key it gives you.
About DKIM selectors
DKIM keys are stored under a "selector" name chosen by your email provider, and there is no way to list them all. This tool tries common ones automatically: google (Google Workspace), selector1 and selector2 (Microsoft 365), k1, k2 and others. If yours is different, find it in your provider's DKIM settings, or in the s= part of the DKIM-Signature header of an email you sent, and enter it above.
Got a warning? See "No DMARC record found" and "DMARC policy not enabled", why DKIM fails, and, for Microsoft 365, how to disable Direct Send.
What the DMARC checker does
This checker looks up a domain's live email records and tells you, in plain English, whether the domain can receive mail and whether it is set up to prove its emails are real. It checks MX, SPF, DKIM and DMARC in one go and gives each a clear pass, warning or problem. It is a quick way to find out why mail lands in spam or bounces with an authentication error.
Benefits
- Four checks in one clickYou get MX, SPF, DKIM and DMARC results together, with a simple score showing how many of the four passed.
- Spots common SPF mistakesIt flags a missing SPF record, two SPF records, a risky +all or weak ?all ending, a missing "all" rule, and records that use too many lookups.
- Explains your DMARC policyIt reads your p= setting and tells you what none, quarantine or reject means for your mail, and whether you are getting reports.
- Finds DKIM without guessworkIf you don't know your DKIM selector, the tool tries common ones such as google, selector1 and selector2. You can also enter your own.
- Shows who handles your emailFrom the MX records it can often name the provider, such as Google Workspace, Microsoft 365, Zoho, Proton or Cloudflare Email Routing.
- Paste almost anythingYou can enter a domain, an email address or a website address. The tool pulls the domain out for you.
- Read-only and safeIt only reads public DNS records. It never changes anything on your domain.
Who it is for
- Small business owners whose emails keep going to spam and who want to know if their domain is set up correctly.
- Email marketers making sure their sending domain meets Gmail, Yahoo and Outlook.com sender rules.
- Web developers and IT helpers checking a client's DNS after moving a website or changing email providers.
- Domain owners confirming that a new SPF, DKIM or DMARC record is live after adding it.
- Anyone curious whether another company's domain is set up to protect against fake email.
How to use it
- Type a domain, email address or website address.
- Add your DKIM selector if you know it, or leave it blank.
- Click Check domain.
- Read the result for each record and follow the advice for anything marked as a problem.
Your privacy
The check runs in your browser. Only the domain name, plus the DKIM and DMARC names built from it, is sent to public DNS services: Cloudflare, with Google as a backup. Nothing is sent to ListaFix.
Questions people ask
- What is a good DMARC policy?
- Start with p=none to collect reports without affecting delivery. Once all your real mail passes SPF or DKIM, move to p=quarantine and then p=reject for the strongest protection.
- Why does my domain fail SPF even though I have a record?
- The most common causes are two separate SPF records, more than 10 DNS lookups, or a sending service that is not listed in the record.
- Does this tool change my DNS?
- No. It only reads public DNS records. Changes are made where your domain's DNS is hosted, such as Cloudflare, Spaceship, GoDaddy or Namecheap.