Free Tool
Email Deliverability Checker
Enter a domain and see whether its email is set up to land in the inbox. SPF, DKIM, DMARC and MX are checked live and explained in plain English, with the fix for anything that fails.
Domain
Live DNS lookups from your browser over DNS over HTTPS. The tool reads public records only: SPF and DMARC on the domain, DKIM on common selectors, and MX. Nothing is sent to the domain.
Free, no signup. Live lookup.
Every result has a shareable link.
What Email Deliverability Actually Depends On
Whether an email reaches the inbox comes down to two things: whether the receiving server can prove the message really came from you, and whether your domain has a good sending reputation. The first part is pure configuration. It lives in three DNS records, SPF, DKIM and DMARC, and it is the part this checker reads. Since February 2024, Google and Yahoo require all three for bulk senders, so a gap here now means rejected or junked mail, not just a lower score.
- SPF lists the servers allowed to send mail for your domain.
- DKIM signs each message with a key, so the receiver can confirm it was not altered and was sent by someone holding your key.
- DMARC ties the two to the From address people see, tells receivers what to do when a message fails, and sends you reports.
How The Checker Works
SPF And The 10 Lookup Limit
The tool reads the TXT records on your domain and finds the one that starts with v=spf1. More than one SPF record is flagged as a failure, because RFC 7208 treats it as a permanent error. It then follows every include: and redirect= recursively and counts each mechanism that costs a DNS lookup: include, a, mx, ptr, exists and redirect. RFC 7208 sets the limit at 10. Past 10, SPF returns a permanent error and fails for every message, including your legitimate ones. This is the most common silent break we see, because each provider you add brings its own nested includes. Google Workspace alone costs four.
The final all mechanism is read as well. -all and ~all are both fine with DMARC enforcement in place. ?all says nothing and gives no protection. +all authorises every server on the internet and should be fixed immediately.
DKIM And Its Honest Limit
DKIM keys live at selector._domainkey.yourdomain.com, and DNS has no way to list the selectors a domain uses. The checker probes over thirty common ones, including google, selector1 and selector2 for Microsoft 365, k2 and k3 for Mailchimp, s1 and s2 for SendGrid, resend and mandrill. Not found means not found on those selectors. Amazon SES, HubSpot and Postmark use account specific selectors no public tool can guess. To find yours, open a recent email, view the original, and read the s= value in the DKIM-Signature header.
DMARC Tag By Tag
The record at _dmarc.yourdomain.com is parsed and each tag gets a plain English verdict: the policy (p=none, quarantine or reject), the subdomain policy sp=, the percentage pct=, the report address rua=, and the alignment modes adkim and aspf. If you enter a subdomain with no record of its own, the parent record is read, because that is what receivers fall back to.
MX
MX records show whether the domain can receive mail. A main domain with no MX cannot get replies or bounces. A send only subdomain without MX is normal.
The Most Common Failure: One Domain For Everything
The checker flags a pattern that causes more deliverability trouble than any single bad record: a root domain whose SPF authorises both a bulk marketing platform (Mailchimp, Klaviyo, Constant Contact, HubSpot, ActiveCampaign) and a transactional or app sender (Amazon SES, SendGrid, Mailgun, Postmark, Resend, SparkPost). Reputation is tracked per domain. When a campaign draws complaints, the damage lands on the same domain your invoices, password resets and sales emails come from. The fix is a subdomain split: campaigns from news.yourdomain.com, app mail from mail.yourdomain.com, and the root kept for people. Each subdomain gets its own SPF and DKIM, and SPF on the root gets shorter, which also fixes most lookup limit problems.
How To Read The Result
- Red items first. A failing SPF or a missing DMARC record affects every message you send today.
- Then the policy.
p=noneis a starting point. It reports but protects nothing. - Then the structure. If the domain separation warning shows, plan the split before you add another sender.
Mistakes To Avoid
- Adding a second SPF record for a new provider instead of merging it into the first.
- Jumping straight to
p=rejectbefore reports show every legitimate sender passing. Use the DNS Record Generator for a dated rollout. - Leaving old providers in SPF. Every unused include still costs lookups.
- Forgetting DKIM on a new tool. SPF alone rarely aligns with your From domain on third party platforms. DKIM is what passes DMARC.
For Agencies
Run this on every new client domain before you send a single campaign. A failing result is a clear, fixed scope piece of work, and it protects the results of everything you build after it. Wise Media runs this same check at the start of every email engagement.
Fix What This Measured
Email Marketing Agency Course
The Email Marketing Agency Course takes this result and turns it into a client service: the domain split, the SPF clean up, the DMARC rollout from none to reject, and the warm up plan, sold as a fixed price deliverability setup.
Rather Not DIY It?
Let Wise Media Build It.
The tool shows the gap. The studio closes it: brand, site, app and AI, then the ads, email, content and search that turn them into revenue.
Website Development
Custom sites with one job per page, built fast for phones, search and AI answers.
From $3,000CAD one timeSee Website DevelopmentApp Development
Web apps, portals and dashboards on Next.js, Supabase and Stripe, installable on any phone.
From $5,000CAD one timeSee App DevelopmentPaid Advertising
Meta, Google and TikTok campaigns built on the offer and page first, reported as one number.
From $750CAD per monthSee Paid AdvertisingSEO & AI Search
Rank in Google, get named by ChatGPT and Gemini, and convert the visit after the click.
From $350CAD per monthSee SEO & AI SearchBrand Identity
Positioning, logo suite, colour, type and the guide that keeps it consistent.
From $750CAD one timeSee Brand IdentityAI Agents & Automation
Custom AI agents, LLM features and n8n automation connected to the tools you already use.
From $1,000CAD one timeSee AI Agents & AutomationContent Production
Short form video, carousels and AI clone content produced on a weekly calendar.
From $750CAD per monthSee Content ProductionEmail Marketing
Campaigns written and sent, lifecycle flows and SMS, every send tied to revenue.
From $350CAD per monthSee Email MarketingWebsite Care
Updates, daily backups, monitoring, edits and search maintenance handled every month after launch.
From $100CAD per monthSee Website CareCyber Security
Email, accounts, staff devices and company data protected, with the documents your insurer asks for.
From $250CAD per monthSee Cyber SecurityEmail Deliverability Checker Questions
Straight answers on using it and acting on the result.
Quick Answer
How Do I Check If My Domain Email Is Set Up Correctly?
Check three DNS records. SPF must be a single record that stays within 10 DNS lookups. DKIM must have a key for every service that sends your mail. DMARC must exist with a report address and, once reports are clean, a policy of quarantine or reject. This checker reads all three live and explains each result.
- SPF limit. 10 DNS lookups, per RFC 7208
- DMARC policies. none, quarantine and reject
- DKIM. Checked on over 30 common selectors
FAQ
Frequently Asked Questions
Enter your domain above. The tool finds the TXT record starting with v=spf1, flags duplicates, follows every include and redirect, and counts DNS lookups against the 10 lookup limit in RFC 7208. It also explains what your all mechanism means.
Receivers stop evaluating and return a permanent error, so SPF fails for every message, including legitimate ones. If DKIM still passes and aligns, DMARC can pass, but you lose one of your two signals. Remove unused includes or move a sender to a subdomain.
DNS cannot list DKIM selectors, so the tool probes common ones. If your provider uses an account specific selector, such as Amazon SES or HubSpot, it will not show. Read the s= value in the DKIM-Signature header of a sent email to find yours.
It is a starting point, not a finished setup. p=none collects reports but lets spoofed mail through. Stay there while the reports show which services send for you, fix any that fail, then move to quarantine and then reject.
Either works once DMARC is enforcing. ~all marks unlisted senders as suspicious and lets DMARC decide. -all tells receivers to fail them outright. Avoid ?all, which gives no protection, and never use +all, which authorises everyone.
Reputation is tracked per domain. Campaign complaints and unsubscribes on the root domain affect your invoices, password resets and one to one email. A subdomain such as news.yourdomain.com keeps campaign reputation separate from the mail that has to arrive.
Yes, for bulk senders. Since February 2024, Google and Yahoo require SPF, DKIM, a DMARC record and easy unsubscribe for domains sending large volumes to their users. A DMARC record with p=none meets the minimum.
No email is sent. The lookups run from your browser against public DNS. The domain is only stored if you download the report and enter your email, so we can follow up with the setup checklist.
More Free Tools
Built from the same toolkits Wise Media runs client work on.
Email List Value Calculator
The revenue an unused email list should be producing.
Use The ToolDNS Record Generator
SPF, DKIM and DMARC records plus the DMARC policy schedule.
Use The ToolWebsite Health Checker
SSL, security headers, platform, speed and email auth, with a risk score.
Use The ToolContrast And Ramp Checker
Every pair in a colour ramp tested at 4.5:1 and 3:1, with a job for each step.
Use The ToolAnswer Block Checker
Does the page answer its question in the first 60 words?
Use The ToolTitle And Meta Description Preview
See your search snippet, its truncation and its click reason.
Use The ToolRather Have It
Done For You?
Wise Media builds and runs this for clients. Thirty minutes with Cody: the bottleneck named, the fix scoped, the price on the table.