mailcheckSPF · DKIM · DMARC
Know your DKIM selector?

DKIM selectors can't be listed from DNS — we guess 45 common ones. If your provider gave you a selector name we don't try, enter it here.

example.com

1 issue worth fixing

52 DNS queries in 45ms · SPF 0/10 lookups · DKIM none found · DMARC p=reject · MTA-STS none · DNSSEC signed

Warning

DMARC collects no reports

With no rua= address you get no aggregate reports, so you cannot see who is sending as your domain or whether your own mail is passing. You are enforcing a policy blind.

Publish this TXT record at_dmarc.example.com
v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s; rua=mailto:dmarc@example.com

Before you publish: The mailbox must exist and will receive daily XML attachments from mailbox providers.

Good

This domain is configured to send no mail

example.com publishes v=spf1 -all, which tells receivers that no server is authorised to send mail as it, and a null MX record declaring it accepts none either. DKIM is not expected here — there is nothing to sign. This is the correct setup for a domain used only for a website.

Good

DMARC is at p=reject

The strongest policy. Mail failing authentication is rejected outright.

Good

DNSSEC is enabled

example.com is signed, so its DNS answers — including every record above — cannot be forged in transit.

Records as published

SPF · example.com
v=spf1 -all
DMARC · _dmarc.example.com
v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s
MX · null MX — this domain accepts no mail
MX 0 .