SPF
Lists the servers allowed to send email for your domain. We flag a missing record, a rule that lets anyone send (+all) or decides nothing (?all), a soft fail (~all), and a record that is close to or over the 10 DNS lookup limit.
Free email authentication check
Check your SPF, DKIM and DMARC records
Enter a domain to see whether the records that stop others sending email as your business are published and set up correctly. No account needed.
Free one-off check. Ongoing monitoring is paid.
What the check looks at
Four checks that decide whether receivers trust email from your domain.
DMARC
Tells receivers what to do with email that fails SPF and DKIM, and where to send reports. We flag a missing record, a policy of none, no reporting address, a policy that covers only part of your email, and subdomains left at none.
DKIM
Signs your outgoing email so receivers can confirm it was not changed. We look for keys under commonly used selectors and flag keys that are weak, revoked or of an unknown type.
MX
Shows where your domain receives email. We flag a missing record, a single mail host with no backup, and a null MX that says the domain accepts no email.
Health score
Combines the findings into one score out of 100. Each distinct problem lowers it once, so you can see at a glance how much work the domain needs, and check again after a fix.
Reading your results
What each result means, and what to fix first.
Each check comes back as pass, warning, fail or error. A warning is a setting that works but leaves a gap. A fail means the record is missing or broken. An error means the DNS lookup did not complete, so run the check again.
SPF and DMARC details show straight away. Add your email address to see the DKIM and MX details. You also get a link to share with whoever manages your DNS.
-
01
Publish SPF and DMARC
If either is missing, receivers have no rule for email that uses your domain without permission. Build them with the SPF record generator and the DMARC record generator.
-
02
Add a DMARC reporting address
Reports show which services send email as your domain, including ones nobody remembers setting up. Already have one? Read it with the free report analyzer.
-
03
Keep SPF under 10 lookups
Remove includes for services you no longer use, and end the record with ~all or -all.
-
04
Tighten DMARC with evidence
Move from none to quarantine, then reject, once reports show your real senders pass.
A DNS finding shows how your domain is set up. It does not show where a particular message landed.
After the check
One check is a snapshot. Records change.
DNS records change when someone adds an email tool, moves providers or edits a record by hand. DemiSignal paid plans check your records on a schedule, alert you when something changes, and read the DMARC reports receivers send, so you can see who is sending email as your domain.
See plans and pricing →Questions, answered
Before you run the check.
Is the check free?
Yes. The one-off check needs no account or card. Scheduled checks, change alerts and DMARC report monitoring are part of the paid plans.
Does the check change my DNS or send email?
No. It only reads the public DNS records of the domain you enter. Nothing is changed and no email is sent.
Why does DKIM show as not found when I use DKIM?
DKIM keys are published under selector names chosen by your email provider. The check tries commonly used selectors. If your provider uses a different one, the key is there but we cannot see it. Your provider’s admin console shows the selector it uses.
What is the SPF 10 lookup limit?
A receiver may make at most 10 DNS lookups while evaluating your SPF record. Each include counts, and so do the includes inside it. Past 10, the record returns an error and can no longer authenticate your email. Removing includes for services you no longer use brings it back under the limit.
Which DMARC policy should I start with?
Start with p=none and a reporting address, so you can see which services send email as your domain. When the reports show your real senders pass SPF or DKIM, move to quarantine, then reject. Moving too early can block legitimate email.
Do Google, Yahoo and Microsoft require these records?
Google, Yahoo and Microsoft require bulk senders to publish SPF, DKIM and a DMARC record, and expect every sender to authenticate its email. Authenticated email is easier for any receiver to trust, whatever your volume.