These results cannot prove why mail goes to spam, that a mailbox exists, or that delivery will succeed. Inspect Authentication-Results in an actual message for SPF/DKIM/DMARC results. Content, IP reputation, complaints and sending practices also affect delivery.
Network
Mail Health and SPF/DMARC
Check MX, SPF, DMARC and a DKIM selector; prepare DNS record drafts for your sending sources and review them before publishing.
01 / QUERY
Inspect your email domain
Query could not be completed
02 / RESULTS
Query completeMail infrastructure findings
Your results will appear here
Enter the information above and start the query.
Data will appear here when it is ready.
Your query is running
Complete the verification above if needed. Your previous results are preserved.
Waiting for the server’s response. This may take a little while.
- Why does this matter?
- Next step
- Current records
Local SPF lookup term count:
The count covers only reachable DNS lookup terms in this record. Nested include/redirect policies, a/mx addresses and an actual sending IP are not evaluated. The 10-term limit includes recursive evaluation; most implementations limit void DNS responses to 2. MX/PTR address expansion also has limits.
Only the supplied domain’s _dmarc name was queried. Subdomains can inherit an organizational domain policy. The effective policy cannot be confirmed without also inspecting the organizational domain and its sp policy.
Review before publishing
Current records
Record draft
Current SPF terms omitted from this draft:
Current policy → proposed policy:
If the report address belongs to another organizational domain, confirm external reporting authorization with your provider. This tool does not query that authorization.
Why does mail go to spam? Where should you start?
SPF concerns the sending server, DKIM the message signature, and DMARC alignment with the visible From domain. Correct DNS may be necessary but cannot guarantee inbox delivery.
Google Workspace setup
- Include every sender in one SPF record. Google Workspace uses include:_spf.google.com; add your website and other services to the inventory too.
- In the Admin console, open Apps → Google Workspace → Gmail → Authenticate email and generate the domain’s DKIM record. Publish the supplied TXT value, then start authentication in that panel.
Official SPF setup guideOfficial DKIM setup guide
Microsoft 365 setup
- Include every sending service in one SPF record. Microsoft 365 uses include:spf.protection.outlook.com; retain other legitimate sources.
- Publish the exact selector1 and selector2 CNAME targets shown for your domain in Microsoft Defender; do not guess them. Enable DKIM signing, then query the selector shown in the panel.
Official SPF setup guideOfficial DKIM setup guide
DMARC
Set up SPF/DKIM first and verify From alignment. Monitor DMARC with none and an authorized reporting address; move to quarantine/reject based on reports. Inspecting a message header is a separate step from checking published DNS.
Official DMARC setup guideGoogle sender requirementsCurrent DMARC standard (RFC 9989)