Find out why your emails land in spam. Enter your domain to check its MX, SPF, DKIM and DMARC records, get a grade, and copy the exact records to fix it.
Reads public DNS records only — nothing is sent from or to your mailbox. No login required.
SPF, DKIM and DMARC are DNS records that prove an email really comes from your domain. SPF lists the servers allowed to send your mail, DKIM adds a cryptographic signature to every message, and DMARC tells receiving servers what to do when a message fails those checks. Since 2024, Gmail and Yahoo require all three from bulk senders, and missing records are the most common reason business emails go to spam.
The most common cause is missing or broken SPF, DKIM or DMARC records, which make receiving servers unsure that the email really came from you. Other causes include sending from a new domain, a shared IP with a poor reputation, or spam-like content. Fix the DNS records first — they are free and quick.
An SPF check may trigger at most 10 DNS lookups (each include, a, mx, exists and redirect counts, including nested ones). Above 10, SPF fails for every email. Remove services you no longer use, or replace includes with ip4/ip6 ranges.
No. A domain must have exactly one TXT record starting with v=spf1. If you use several services, merge their include: entries into one record.
Start with p=none and a rua reporting address to see who sends email as your domain. Once all your legitimate senders pass, move to p=quarantine and then p=reject to stop spoofing.
A selector is the name your email provider uses for its DKIM key, published at selector._domainkey.yourdomain.com. Google Workspace uses "google", Microsoft 365 uses "selector1" and "selector2". You can find yours in your provider's DKIM settings or in the DKIM-Signature header (s=) of an email you sent.
Usually a few minutes to an hour, though some providers take up to 48 hours. Run the check again after you update your records.
Last updated: · Free tool by Regdec Enterprise
Free Web Tools