Where do I find my DKIM selector?

Your email provider can supply the selector. You can also read the s= value in the DKIM-Signature header of a message sent by your domain. Enter that selector with the matching domain; the checker does not guess selectors.

Does a DMARC policy of none mean my email is rejected?

No. The none policy requests monitoring rather than quarantine or rejection based on DMARC failure. This checker reports the published policy; it does not test how a particular receiving mail system handles a message.

Does a passing DNS check guarantee email deliverability?

No. DNS configuration alone does not prove message authentication, sender reputation or inbox placement. Review real message headers and your mail provider’s delivery reports alongside these published records.

Is this tool free and do I need an account?

It is free to use without an account. Domain checks have request limits to protect public services. Results can be downloaded from this page.

Where is my input processed?

Checks run on our server and contact public DNS, registry, website or Ahrefs services as needed. Results can be cached; inputs are not added to your URL or account. Do not submit private addresses or secrets.

Email DNS checker

Check SPF, DKIM, DMARC and MX records for your email domain. Inspect published DNS policies and mail server priorities, then export a CSV report.

A report you can act on

Enter your domains to see measured values, sources and check times. Missing records, unsupported services and temporary failures are shown separately.

From input to output

How to use it

Check the SPF, DMARC and MX records published for an email domain, plus a DKIM record when you supply its selector. This free email DNS checker reports published policies and mail server priorities in one downloadable report. No account is required.

Enter the domain used for email.
For DKIM, enter the selector supplied by your mail provider or the s= value from a signed email.
Review published SPF, DMARC and MX records, plus DKIM if supplied. Resolver failures remain visible.

What SPF, DKIM, DMARC and MX results tell you

SPF publishes a domain’s sender policy. DKIM publishes a key under a named selector. DMARC publishes a policy for handling messages that fail its authentication requirements. MX records identify receiving mail exchangers and their priorities.

This checker reads those DNS records and flags selected issues, such as multiple policy records, an SPF +all policy, missing or invalid DMARC policy values and malformed DKIM keys. It reports the lookup names so you can compare them with your mail provider’s configuration.

Separate published DNS from email delivery

A published record is one part of email setup. This tool does not send an email, verify a message signature, test DMARC message alignment or prove inbox placement. It also does not expand SPF includes or calculate the recursive SPF DNS lookup budget.

Use a DKIM selector from your provider or the s= value in a real DKIM-Signature header. Without it, DKIM is marked not checked. Resolver failures remain unavailable rather than being reported as missing records. A subdomain DMARC lookup can fall back to its organizational domain.

Measurement and usage limits

This checks DNS configuration, not inbox placement or a message signature. SPF include expansion and its recursive DNS lookup limit are not evaluated. DMARC alignment is not tested. Without a selector, DKIM is not checked, never labelled missing.

Frequently asked questions

Where do I find my DKIM selector?: Your email provider can supply the selector. You can also read the s= value in the DKIM-Signature header of a message sent by your domain. Enter that selector with the matching domain; the checker does not guess selectors.
Does a DMARC policy of none mean my email is rejected?: No. The none policy requests monitoring rather than quarantine or rejection based on DMARC failure. This checker reports the published policy; it does not test how a particular receiving mail system handles a message.
Does a passing DNS check guarantee email deliverability?: No. DNS configuration alone does not prove message authentication, sender reputation or inbox placement. Review real message headers and your mail provider’s delivery reports alongside these published records.
Is this tool free and do I need an account?: It is free to use without an account. Domain checks have request limits to protect public services. Results can be downloaded from this page.
Where is my input processed?: Checks run on our server and contact public DNS, registry, website or Ahrefs services as needed. Results can be cached; inputs are not added to your URL or account. Do not submit private addresses or secrets.