SPF, DKIM and DMARC checker
A cold email domain checker: enter a sending domain and see in seconds whether MX, SPF, DKIM and DMARC are set up right, with the exact record to fix each one.
Email me this report and the fix list
One email with these results and the records to change, to forward to whoever manages your DNS.
Results reflect public DNS at the moment you ran the check, and recent changes can take time to show everywhere. This is a configuration check, not an inbox placement test.
We found two DMARC records on our own sending domain
One said p=reject and the other said p=none. Under RFC 7489, a receiver that finds more than one DMARC record applies no DMARC policy at all, so the strict one protected nothing. This checker counts the records first and fails the check when there is more than one.
_dmarc v=DMARC1; p=reject; ...
_dmarc v=DMARC1; p=none; ...
SPF lists who may send for your domain, DKIM signs each message, and DMARC tells receivers what to do when those checks fail. MX is where replies land.
| Record | Where it lives | What good looks like |
|---|---|---|
| SPF | yourdomain.com | One v=spf1 record ending in ~all or -all, 10 or fewer DNS lookups |
| DKIM | selector._domainkey | A key for every tool that sends as you, 2048-bit where supported |
| DMARC | _dmarc.yourdomain.com | Exactly one v=DMARC1 record with a p= policy and a rua= report address |
| MX | yourdomain.com | Points at a real mailbox provider, so replies do not bounce |
Cold email domain setup checklist
Eight things to have in place before a new sending domain goes into a campaign. Run this checker again after every DNS change.
- Send from a separate domain, not the one your company runs on.
- Give it MX records on a real mailbox provider, so replies reach a person.
- Publish one SPF record listing only the services that send for you, ending in
~allor-all. - Turn on DKIM in every sending tool, with a 2048-bit key where supported.
- Publish exactly one DMARC record, starting at
p=nonewith arua=address. - Tighten to quarantine, then reject once reports show only your own senders.
- Make the From domain match the domain that passes SPF or DKIM. That alignment is what DMARC checks.
- Size inboxes and domains before volume with the cold email infrastructure calculator.
Sources, checked October 2026: Google email sender guidelines · RFC 7208 (SPF) · RFC 6376 (DKIM) · RFC 7489 (DMARC)
Questions
Questions people ask before they send.
SPF lists the servers allowed to send email for your domain. DKIM signs each message with a key published in your DNS, so receivers can verify it was not altered. DMARC sits on top of both: it tells receivers what to do when a message fails, and sends you reports. Cold email needs all three.
Receivers ignore DMARC for that domain. RFC 7489 says that when policy discovery finds more than one DMARC record, it stops and no policy is applied. That is how one of our own sending domains, with one p=reject record and one p=none record, effectively had no DMARC at all. Delete all but one.
DKIM keys live at a selector name your sending tool picks, and DNS has no way to list selectors. We probe the common ones, so a tool with a unique selector will not show up. Find the selector in your tool's DNS settings, or in the s= value of the DKIM-Signature header on a sent email, then check that a record exists at that selector._domainkey on your domain.
Google's sender guidelines require every sender to Gmail to set up SPF or DKIM. Senders of more than 5,000 messages a day to Gmail must have SPF, DKIM and a DMARC record, where p=none is allowed, and the From domain must align with the SPF or DKIM domain. Checked October 2026.
Free 30 minute signal audit
Your domain passes. Now, who should you email?
A clean domain only gets you delivered. The signal audit maps the buying signals for your ICP, so your next campaign goes to accounts with a reason to reply.
Pick a time in the calendar below to schedule a 30 minute call with me.
- 01You talk. Who you sell to and what you send today.
- 02We map. The signals that fire for your ICP and the two to start with.
- 03You keep it. The signal map and a budget range, whether or not you build with us.
Ishan Vats, founder of IV Consulting. We run our own outbound, which is how we caught the duplicate DMARC record.
More free GTM tools: Signal library · Cold email calculator · GTM glossary · GTM and CRM setup
Loading the calendar. If it does not appear, book the signal audit on cal.com.