Email Record Checker
Anyone can send an email that looks like it came from your domain. Three settings, called SPF, DKIM and DMARC, let email services check whether an email is real. Enter your domain to see if yours are set up, then follow the steps to fix anything that is missing.
Check my domain
Type the part of your email address after the @. For jane@example.com, enter example.com.
Learn email security
What the words and settings in this tool mean. Tap an item to open it.
Start here
Anyone can write any "From" address on an email. Nothing checks it by default. So someone can send an email that says it's from you@yourcompany.com when it isn't. This is called spoofing. Scammers use it to trick your customers and staff.
SPF, DKIM and DMARC are three settings you add to your domain. They let Gmail, Outlook and other email services check whether an email really came from you.
SPF
A list of the services that can send email as your domain, such as Google Workspace or Mailchimp. Email from anywhere else looks suspicious.
DKIM
A digital signature added to each email you send. The receiving service checks it. It shows the email came from you and wasn't changed on the way.
DMARC
Says what to do with email that fails the SPF and DKIM checks: do nothing, put it in spam, or block it. It also sends you reports on who is sending email as you.
You need all three. SPF can fail when an email is forwarded, but DKIM usually still works. DMARC makes sure the checks are for your domain and tells receivers what to do when they fail. Google and Yahoo require all three from anyone who sends a lot of email (about 5,000 a day or more).
Nothing matches that. Try a shorter word, like spf, key or report.
Set up SPF who can send your email
SPF is a list of the services allowed to send email from your domain. Anything not on the list looks suspicious to receivers.
Not sure which you use? Enter your domain and we'll look at your current settings and tick them for you.
More options (most people can skip this)
TXT@How do I add this?
Set up DMARC what to do with fakes
DMARC tells receiving mail services what to do with email that pretends to be you, and sends you reports so you can see who is sending as your domain.
Use an address you check. You'll receive a daily summary from big mail providers. Tip: a dedicated address like dmarc@yourdomain keeps them out of your inbox.
More options (most people can skip this)
TXT_dmarcHow do I add this?
Moving from watching to blocking
- Start with "Just watch". Nothing can break.
- Read the reports for two to four weeks. Look for legitimate services (newsletters, invoicing, helpdesk) that aren't passing, and ask them how to set up SPF or DKIM for your domain.
- Switch to "Send fakes to spam". Optionally start at 10% in More options and raise it over time.
- Finish with "Block fakes completely".
The reports arrive as technical files. A free DMARC report reader service can turn them into a readable weekly summary.
Set up DKIM the email signature
DKIM adds a digital signature to each email you send. Receivers use it to check the email is real and wasn't changed on the way.
You usually don't need to create anything yourself. Your email provider makes the key. You switch it on and copy the record it gives you into your domain. Pick your provider:
Google Workspace (Gmail for business)
- Sign in to the Google Admin console (admin.google.com) as an administrator.
- Go to Apps > Google Workspace > Gmail > Authenticate email.
- Choose your domain and click Generate new record (2048-bit is best).
- Copy the Name and Value it shows into your domain's DNS as a TXT record (see "How do I add this?" below).
- Return to the Admin console and click Start authentication. This can take up to 48 hours to show as active.
Microsoft 365 (Outlook for business)
- Sign in to the Microsoft Defender portal (security.microsoft.com) as an administrator.
- Go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings, then the DKIM tab.
- Select your domain. Microsoft shows two CNAME records (names starting
selector1._domainkeyandselector2._domainkey). - Add both to your domain's DNS exactly as shown. They are CNAME records, not TXT.
- Back in the portal, switch Sign messages for this domain with DKIM signatures to on.
Mailchimp, SendGrid, Mailgun, or another service
Open that service's settings and look for Domain authentication, Sender authentication or DKIM. It will show you records to copy into your domain's DNS. Follow its on-screen steps, then use "Check my domain" to confirm.
How do I add a record to my domain?
I run my own mail server and need to create a key
Only for people who manage their own mail server. If you use any provider above, skip this.
Show the key generator
Decode a record
Already have a record and want to know what it means? Paste it here and we'll explain what it means and point out any mistakes.
Free to use. The checker sets no cookies and stores nothing on your device. The only thing it sends anywhere is your domain name (and, as with any web request, your IP address), to a public DNS service (Cloudflare, or Google if Cloudflare doesn't answer), when you press Check. See our privacy policy. Changes to DNS can take up to an hour (sometimes longer) to show up.
Need a hand with your results?
If a result doesn't make sense or you'd rather someone else made the changes, tell us a bit about your setup and we'll point you in the right direction, with no obligation.