mailcheckSPF · DKIM · DMARC

Find out why your email is failing authentication

Enter a domain. We read its public DNS records and tell you exactly what to publish to fix what's broken — not just that something is.

Know your DKIM selector?

DKIM selectors can't be listed from DNS — we guess 45 common ones. If your provider gave you a selector name we don't try, enter it here.

What this checks

SPF, counted properly
SPF permits ten DNS lookups and no more. Past that, receivers give up and your record stops working — silently, with no bounce and no warning. We walk the whole include: chain, follow redirect=, and show you the count. If you're over, we generate a corrected record that flattens only the includes it has to.
DKIM, without inventing selectors
Selectors can't be listed from DNS, so every checker guesses. The catch is that some domains answer every DNS query, which makes careless tools report keys that don't exist. We verify each hit is genuinely a signing key, and tell you plainly that a miss isn't proof DKIM is absent.
DMARC, including where your reports actually go
We check policy inheritance for subdomains, and whether third-party report addresses are authorised to receive your data. That last one catches a failure most tools miss entirely: a DMARC record that looks perfect while the reports go nowhere.

Why bother

Since February 2024, Google and Yahoo require SPF, DKIM and DMARC from anyone sending them bulk mail. Domains that don't comply get throttled or rejected, and the failure is usually invisible from the sending side — your mail simply stops arriving.

Try one of these