Free tool
Is your email properly signed?
Check in seconds whether your domain has SPF, DKIM and DMARC set up the way they should be. Everything runs from your browser against public DNS: we store nothing.
What these three records do
SPF says who may send
A public list of the servers allowed to send mail using your domain. If you send with Klaviyo, Klaviyo has to be on that list. The end of the record sets how tight it is: -all rejects unauthorised mail, ~all only flags it as suspicious.
DKIM signs every send
It adds a cryptographic signature to each message, which the receiver verifies against a public key in your DNS. It proves the message came from who it claims and was not altered in transit. In ecommerce that key usually sits on the sending subdomain, not the main domain.
DMARC decides what happens on failure
It ties the other two together and tells providers what to do with mail that fails the checks: nothing (p=none), spam (p=quarantine) or refusal (p=reject). It also sends you reports on who is sending in your name.
Common questions
- Why does another checker tell me I have no DKIM?
- Because almost all of them look only at the root domain. When sending is branded, the key lives on the subdomain you send from, and that is where we look.
- Does this tell me whether I land in spam?
- It covers the part that can be checked from outside without access to your account. Authentication is the foundation, but deliverability also depends on who you send to, how often, and how many people open. That needs your data. We review it in a 30-minute call.
- Do you store the domain I check?
- No. Your own browser makes the query against the public Google and Cloudflare resolvers. We never see it and never store it.
- Something is missing, is that serious?
- It depends which. With no SPF or DKIM your mail can be impersonated and providers distrust it. A DMARC at p=none protects nothing but breaks nothing either. What matters is having all three, then tightening the policy.
Authentication is the foundation, not the house
Having the records right does not guarantee the inbox. In a 30-minute call we look at your whole account and tell you what is holding your sending back.