SPF
Check the envelope sender domain.
Start with the domain used in the Return-Path. The tool reads its SPF record; it does not evaluate a sending IP or recursively follow every include.
Email Domain Checker · Published-record review
Make sense of the records behind your email.
Inspect SPF, DMARC and an optional DKIM selector. Understand what is published, what needs attention and what still needs testing with your email provider.
Check your domain
Email Domain Checker
Start with the right domain.
Enter a domain, not an email address or URL. Live checks query Google Public DNS, which receives the domain and optional selector. The tool does not send an email.
02 / Review the setup
Your email domain report
Enter a domain or load an illustrative example.
Plain-text report
Put it to work
Three checks. Different parts of the picture.
The domain on your website is not always the domain used by each part of your email setup. Use a real message’s headers to identify what to inspect.
DMARC
Check the visible From domain.
The report reads the exact-domain policy. A missing record here does not rule out an inherited policy, and finding one does not test alignment.
DKIM
Pair the signing domain with its selector.
Find d= and s= in a DKIM-Signature header, or ask your provider. If the signing domain differs, run a separate check. Without a selector, DKIM remains unchecked.
Illustrative example
Read the finding. Then choose the next check.
These deliberately invented records match the tool’s Load example report. They illustrate interpretation and must not be copied into your DNS settings.
SPF · Record found
The include is a starting point.
v=spf1 include:_spf.example.com -allThe checker can see an include mechanism. It does not expand that policy or confirm whether an actual sending IP passes SPF.
DMARC · Monitoring policy
p=none is not a delivery guarantee.
v=DMARC1; p=none; rua=mailto:reports@example.comThis policy requests neither quarantine nor rejection. Review legitimate senders and alignment with your provider before considering an enforcement change.
DKIM · Configuration review
An empty key means revoked.
v=DKIM1; k=rsa; p=The empty public-key value marks this example selector as revoked. Confirm which selector your service currently signs with; this does not establish that every selector is broken.
Published records are one layer of evidence. Actual message authentication, domain alignment and inbox placement need separate checks.
Before you move on
Take a useful report to your provider.
Include the queried names.
Record the domain and selector used. If SPF, visible From and DKIM signing domains differ, keep their results separate.
Distinguish unavailable from missing.
A timeout or resolver error does not prove a record is absent. Retry or inspect it with your DNS provider before drawing a conclusion.
Verify a real message next.
Ask your provider to review the authentication results and alignment for an authorised test message. This tool does not validate signatures, key strength or inbox delivery.
Your questions
Know what the result means.
Can this confirm my emails will reach the inbox?
No. It inspects published records with limited checks. It does not send a message or test reputation, content, recipient filtering, message authentication or inbox placement.
Where do I find the DKIM selector?
Open a message’s full headers and locate DKIM-Signature. Use s= as the selector and d= as the signing domain. Your email provider can also supply these values; selectors are not guessed.
Should I add another SPF record if one already exists?
Do not use this report as an instruction to add duplicate records. Ask the DNS administrator to review the existing policy and all legitimate senders. The checker flags multiple candidate records for review.
Make the enquiry journey work end to end.
If website enquiries are not reaching the right place, send us the context. We can help review the website’s handoff and identify what your email provider needs to investigate.
Send an enquiry