Mail that bounces or lands in spam usually comes down to a few DNS records and the reputation of the server that sent it. These tools read those records straight from DNS so you can check each piece of a domain's email setup.
v=spf1 TXT record that lists who may send mail for the domain. A domain must have exactly one SPF record, and evaluating it may take no more than 10 DNS lookups (include, a, mx, ptr, exists and redirect each count).selector._domainkey.example.com. The selector is the s= value in the DKIM-Signature header of a message the domain sent. Need a key? Use the DKIM Generator, or the key your email provider gives you._dmarc.example.com: what receivers should do with mail that fails (p=none, quarantine or reject) and where to send reports (rua=).| SPF | DKIM | DMARC | |
|---|---|---|---|
| Question it answers | Is this server allowed to send for the domain? | Was the message signed by the domain, and is it unchanged? | What should receivers do when SPF and DKIM don't line up with the From address, and where should they report? |
| Where it is published | TXT record on the domain, starting v=spf1 | TXT record at selector._domainkey.domain | TXT record at _dmarc.domain, starting v=DMARC1 |
| Domain it checks | The envelope sender (Return-Path) | The d= domain in the DKIM-Signature header | The visible From domain, which must match (align with) the SPF or DKIM domain |
| Common problems | Two SPF records; more than 10 lookups; a sending service missing from the record | Wrong selector; key not published or split incorrectly across strings | Left at p=none indefinitely; no aligned SPF or DKIM, so legitimate mail fails |
DMARC passes when either SPF or DKIM passes and uses a domain that aligns with the From address. Forwarded mail often breaks SPF, so a working DKIM signature is what keeps DMARC passing in practice.
Since February 2024 Gmail and Yahoo require bulk senders (roughly 5,000 or more messages a day to their users) to publish SPF and DKIM, have a DMARC policy, and send from IPs with valid forward and reverse DNS. Smaller senders still need SPF or DKIM to avoid being filtered. If a domain sends any mail at all, every check above is worth running.