Free tool
SPF, DKIM & DMARC checker and domain health check for cold email
Enter a sending domain to get a grade, the mailbox provider behind it, the exact records to fix, and a pass/fail list against the Gmail, Yahoo and Microsoft bulk sender rules. No signup.
What this domain health check covers
SPF
One record only, at most 10 DNS lookups, and a ~all or
-all ending. If your mailboxes are on Google Workspace or
Microsoft 365 and SPF doesn't include them, we write the corrected record for you.
DKIM
Finds your public key, estimates its size (2048-bit is the floor to aim for), and flags
revoked keys and testing mode (t=y).
DMARC and alignment
Reads the policy, report addresses and adkim/aspf
modes, then tells you whether DMARC will pass when you send from your own mailboxes.
MX and provider
Confirms replies can reach you and names the host: Google Workspace, Microsoft 365, Zoho, Proton, Fastmail, Namecheap Private Email, security gateways and forwarders.
The grade counts six DNS checks (SPF, DKIM, DMARC policy, DMARC reports, alignment and MX). A pass is one point, a warning half. 90% or more is an A. The summary line tells you exactly how many passed, so the grade is never a black box.
What a healthy cold email domain looks like
For a domain with mailboxes on Google Workspace, these three records are all you need. Swap
the SPF include for your provider (Microsoft 365 uses
spf.protection.outlook.com).
SPF, a TXT record on the root domain
v=spf1 include:_spf.google.com ~all
DKIM, a TXT record at google._domainkey
v=DKIM1; k=rsa; p=MIIBIjANBgkqh… (generated in the Google Admin console)
DMARC, a TXT record at _dmarc
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
The usual cold email failure isn't a missing record. It's DKIM never being switched on.
Google Workspace signs mail with a gappssmtp.com domain until you generate
your own key, so DMARC depends on SPF alone, and SPF breaks whenever a message is
forwarded. Turn on DKIM for every sending domain before the first campaign.
Every domain you send from needs its own records. If you spread volume across several secondary domains, run each one through this checker. They don't inherit anything from your main domain.
DNS only tells half the story. The checker can't see your spam complaint rate, unsubscribe headers, reverse DNS or TLS, so those rows in the requirements table say "Can't check from DNS" and link to where you can verify them. Track complaints in Google Postmaster Tools, and read the cold email deliverability checklist and deliverability fundamentals for the rest. For step-by-step setup, see how to set up SPF, DKIM and DMARC.
Frequently asked questions
- How do I check if SPF, DKIM and DMARC are set up correctly?
- Enter your domain above. We read the SPF record on your root domain, look for a DKIM key at your selector (or 27 common ones), read the DMARC record at _dmarc.yourdomain.com and check that they work together. To confirm that real mail passes, send yourself a message and read the Authentication-Results header, or paste the headers into our email header analyzer.
- Why can't the checker find my DKIM record?
- DKIM keys live at <selector>._domainkey.yourdomain.com, and DNS has no way to list selectors. We try the defaults used by Google Workspace (google), Microsoft 365 (selector1, selector2), Proton, Fastmail, SendGrid, Mailgun and others. If you use a custom selector, find it in the s= tag of a DKIM-Signature header on a message you sent, and enter it in the selector field.
- Is DMARC p=none enough for Gmail, Yahoo and Microsoft?
- Yes. All three accept p=none as the minimum for bulk senders. It never blocks mail, but it still makes receivers check alignment and, with rua=, sends you reports. Move to p=quarantine once the reports show every legitimate sender passing.
- What are the Gmail, Yahoo and Microsoft bulk sender requirements?
- Senders of roughly 5,000+ messages a day to that provider must publish SPF and DKIM, publish DMARC with at least p=none, and have the From: domain align with SPF or DKIM. Gmail and Yahoo also require a spam rate below 0.3% and one-click unsubscribe for marketing and subscribed mail; Gmail and Yahoo require valid forward and reverse DNS for sending IPs, and Gmail requires TLS.
- Does cold email need one-click unsubscribe?
- Google and Yahoo write the rule for marketing and subscribed messages, and cold outreach is unsolicited, so it's a grey area. Adding List-Unsubscribe and List-Unsubscribe-Post headers costs nothing, keeps you compliant if a receiver classes your mail as promotional, and turns some spam complaints into quiet unsubscribes.
- What does DMARC alignment mean?
- DMARC passes only if SPF or DKIM passes for a domain that matches the one in your From: address. Relaxed alignment (the default) accepts subdomains; strict needs an exact match. Sending from a Gmail or SMTP mailbox signed with your own DKIM key aligns in both modes.
Related free tools
- Email header analyzer See whether SPF, DKIM and DMARC actually passed on a real message.
- SMTP error codes Decode bounces like 550 5.7.26 and 5.7.515 authentication failures.
- Cold email checker Catch spammy copy before it costs you inbox placement.
- Cold email infrastructure calculator Work out how many domains and inboxes your volume needs.
Try Clement free for 14 days
Once your domain passes, connect its Gmail or SMTP inboxes to Clement and send your first campaign from mailboxes that authenticate as you.
Start free trial