See if a stranger can send mail as this domain. Get the records that stop it.
Type the domain. You get the pass, fail, or not-found line for each record, and the SPF and DMARC values to paste, with a copy button. Nothing is held back for a paid plan, and nobody logs in to your DNS.
What the three records do
SPF is one TXT record on the domain that lists the servers allowed to send its mail, for example v=spf1 include:_spf.google.com ~all. It fails when there is none, when there are two (receivers then ignore both), or when its includes need more than 10 DNS lookups. The checker counts the lookups for you.
DKIM is a public key at selector._domainkey.example.com. The sending service signs each message, and the receiver checks the signature with that key. Each service that sends for you, such as Google Workspace, Microsoft 365 or a newsletter tool, needs its own key.
DMARC is a TXT record at _dmarc.example.com, for example v=DMARC1; p=none; rua=mailto:reports@example.com. It tells receivers what to do with mail that fails SPF and DKIM: nothing (p=none), spam folder (p=quarantine) or reject (p=reject). Since 2024, Gmail and Yahoo ask bulk senders for one; without it, mail is rejected with errors such as 550 5.7.26.
How to read the result
- pass: the record is there and well formed.
- fail: the record is there but broken or weak, and the line says what to change.
- not found: no record. For DKIM this can mean a custom selector name: type it above and check again.
- unknown: public DNS did not answer in time, so nothing was decided. Check again in a few minutes.
What it cannot see: blocklists, your sending server's reputation and what your emails say. If all three pass and mail still lands in spam, the cause is one of those.
Fix it yourself, or have it done
Most fixes are one record each: merge two SPF records into one, add the include of a service that sends for you, turn on DKIM in your mail provider's admin page, and publish a DMARC record that starts at p=none. Then check again here.
The result above gives those records for your domain, free: the SPF and DMARC values to paste, built from what you have now, and the DKIM steps for your mail provider when it is one the checker knows. If you would rather have a person do it, Mailfix checks every service that sends for you and checks again after you apply the records, for 49 USD per domain for the first 10 customers, then 79 USD. Nobody logs in to your DNS.
The checker runs our Domain Mail Check tool, which an AI agent can call too. Install steps: Claude, ChatGPT, Cursor.
Frequently asked questions
Do I need access to the domain's DNS account?
No. SPF, DKIM and DMARC are public DNS records, so anyone can read them for any domain. The checker reads them through public DNS over HTTPS and never asks for a login.
Why does DKIM say not found when my mail is signed?
A DKIM key sits under a selector name that your mail provider picks, and DNS cannot list them. Without a name the checker tries 10 common ones. Type yours in the selector field: it is the s= value in the DKIM-Signature header of an email you sent (Show original in Gmail).
Is it free, and is my domain stored?
It is free and needs no sign-up. A result stays in a short cache so a repeat check is fast; beyond that, only a daily count of checks is stored, with no domain and no network address. Many checks from one network in a short time are paused for a minute.
Can my AI agent run the same check?
Yes. Add the free Domain Mail Check MCP server to Claude, ChatGPT, Cursor or another MCP client and ask it to check a domain, or have the agent open this page with ?domain=example.com and read the element with id mf-result.