# SPF, DKIM and DMARC checker

> Free SPF, DKIM and DMARC checker for cold email. Enter your domain to see each record, what's missing or broken, and how to fix it before you send.

A free checker for the DNS records that decide whether cold email reaches the inbox. Enter a domain or an email address at https://www.outboundllama.com/tools/spf-dkim-dmarc-checker to see its SPF, DKIM, DMARC and MX records, what is missing or broken, and how to fix it. No sign-up is needed.

## What each record does

- **SPF.** A TXT record on your domain that lists the servers allowed to send mail for it. It starts with v=spf1, and a domain must have exactly one. End it with ~all or -all, and keep it under 10 DNS lookups.
- **DKIM.** A key your email provider uses to sign each message, published as a TXT record under a selector, such as google._domainkey for Google Workspace or selector1._domainkey for Microsoft 365. Receivers use it to check the mail wasn't changed and really came from you.
- **DMARC.** A TXT record at _dmarc.yourdomain that tells receivers what to do when SPF or DKIM fails, and where to send reports. Gmail, Yahoo and Microsoft expect one from domains that send a lot of mail.
- **MX.** The servers that receive mail for your domain. Without them, replies to your cold emails bounce.

## Common fixes

- **Google Workspace.** SPF: v=spf1 include:_spf.google.com ~all. Turn on DKIM in the Admin console under Apps, Google Workspace, Gmail, Authenticate email, then publish the key it gives you.
- **Microsoft 365.** SPF: v=spf1 include:spf.protection.outlook.com -all. Turn on DKIM in the Microsoft Defender portal under Email authentication settings, then publish the two CNAME records it shows.
- **DMARC to start with.** v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Once the reports show your mail passing, move to p=quarantine.
- **Two SPF records.** Merge them into one: keep a single v=spf1, put every include in it, and end with one ~all or -all.

## Questions

### Do I need SPF, DKIM and DMARC for cold email?

Yes. Gmail, Yahoo and Microsoft check them on every message, and mail from a domain without them is far more likely to land in spam or be refused. Set up all three before you send your first campaign.

### What is the difference between ~all and -all in SPF?

~all (soft fail) asks receivers to accept mail from other servers but treat it with suspicion. -all (hard fail) asks them to refuse it. Both are fine for sending; +all and ?all are not.

### Why does the checker find no DKIM key?

DKIM keys live under a selector chosen by your email provider. The checker tries the common ones. If yours uses a different name, check your provider's DKIM settings; if signing is off there, turn it on and publish the key.

### How long do DNS changes take?

Usually minutes to a few hours, and up to 48 hours in some cases. Check again after you change a record.

### Should I send cold email from my main domain?

Many teams send from a second domain, such as getacme.com, so a spam complaint can't hurt the mail their main domain sends. Set SPF, DKIM and DMARC on that domain too, and give new mailboxes a few weeks to build up volume.

Canonical: https://www.outboundllama.com/tools/spf-dkim-dmarc-checker
Last updated: 2026-10-27

## Related

- [Home](https://www.outboundllama.com/)
- [Pricing](https://www.outboundllama.com/pricing)
- [Sign up](https://www.outboundllama.com/signup)
- [Sign in](https://www.outboundllama.com/login)
- [Forgot password](https://www.outboundllama.com/forgot-password)
- [Cold email tool comparisons](https://www.outboundllama.com/alternatives)
- [Instantly alternative](https://www.outboundllama.com/alternatives/instantly)
- [Smartlead alternative](https://www.outboundllama.com/alternatives/smartlead)
- [lemlist alternative](https://www.outboundllama.com/alternatives/lemlist)
- [Apollo.io alternative](https://www.outboundllama.com/alternatives/apollo)
- [Hunter alternative](https://www.outboundllama.com/alternatives/hunter)
- [Woodpecker alternative](https://www.outboundllama.com/alternatives/woodpecker)
- [Reply.io alternative](https://www.outboundllama.com/alternatives/reply-io)
- [Mailshake alternative](https://www.outboundllama.com/alternatives/mailshake)
- [Snov.io alternative](https://www.outboundllama.com/alternatives/snov-io)
- [RocketReach alternative](https://www.outboundllama.com/alternatives/rocketreach)
- [Lusha alternative](https://www.outboundllama.com/alternatives/lusha)
- [ZoomInfo alternative](https://www.outboundllama.com/alternatives/zoominfo)
- [Seamless.AI alternative](https://www.outboundllama.com/alternatives/seamless-ai)
- [Findymail alternative](https://www.outboundllama.com/alternatives/findymail)
- [Prospeo alternative](https://www.outboundllama.com/alternatives/prospeo)
- [Clay alternative](https://www.outboundllama.com/alternatives/clay)
- [Opt out](https://www.outboundllama.com/opt-out)
- [Terms](https://www.outboundllama.com/terms)
- [Privacy](https://www.outboundllama.com/privacy)