Do I need an account to use this tool?

No. No account, no email address, no form to fill in. You enter a domain, we read its public DNS and show the result. Nothing is stored.

Where does this information come from?

From public DNS, queried at the moment you load the page. These are exactly the records any mail server consults before accepting a message from your domain. You can check them yourself with the “dig” command.

My DKIM shows as not detected — is that bad?

Not necessarily. A DKIM selector has no fixed location: your sending service chooses its name. We try the most widespread selectors, and some services draw a random one per domain. A DKIM not detected here may well exist.

Why is there no overall score?

Because we would have to invent it. A DNS record contains nothing from which a deliverability score could be computed, and a number backed by no measurement only serves to impress. We would rather show what we read.

I have just published my records and they are not showing.

DNS takes time to propagate — from a few minutes to a few hours, depending on your host and the declared time to live. Wait, then read again.

Free tool

Check your domain's SPF, DKIM and DMARC

Three records decide what a mail server does with your emails. Enter your domain: we read them from public DNS, show you what they contain, and tell you what it means.

No sign-up
No email address
Nothing is stored

Or look at a well-known domain:leboncoin.fr gouvernement.fr github.com wikipedia.org

The three records, in plain English

They do different jobs, and one does not replace another. It is their combination that lets a server decide.

SPF

The list of authorised senders

A TXT record published at your domain root, listing the servers allowed to send on your behalf — yours, your business mailbox provider's, your email marketing tool's.

When a message shows up, the receiving server looks at where it actually came from and compares that to the list. The final mechanism — “-all”, “~all”, “?all” — says what to do with servers that are not on it.

DKIM

The message signature

Your sending service signs each message with a private key. The matching public key is published in your DNS, at a location whose name — the selector — is chosen by that service.

The receiving server verifies the signature. If it is valid, the message was not altered in transit and does come from a service you authorised.

DMARC

The instruction, and the report

A TXT record on “_dmarc.your-domain” that answers a question SPF and DKIM leave open: what do we do with a message that fails both?

It does a second thing, often forgotten: it collects reports. The address declared in “rua” receives a summary of everything sent in your name, including by servers you know nothing about.

The three DMARC policies

It is the value after “p=”. Publishing DMARC protects nothing until you have left the first row of this table.

Policy	What you ask for	What it protects
`p=none`	Change nothing, but send me the reports.	Nothing. It is an observation stance, meant to be temporary.
`p=quarantine`	Put unauthenticated messages in the spam folder.	Impersonation stops paying off: the message arrives, but in a folder nobody opens.
`p=reject`	Refuse unauthenticated messages.	The message does not arrive at all. It is the only setting that truly closes the door.

Frequently asked questions

Do I need an account to use this tool?: No. No account, no email address, no form to fill in. You enter a domain, we read its public DNS and show the result. Nothing is stored.
Where does this information come from?: From public DNS, queried at the moment you load the page. These are exactly the records any mail server consults before accepting a message from your domain. You can check them yourself with the “dig” command.
My DKIM shows as not detected — is that bad?: Not necessarily. A DKIM selector has no fixed location: your sending service chooses its name. We try the most widespread selectors, and some services draw a random one per domain. A DKIM not detected here may well exist.
Why is there no overall score?: Because we would have to invent it. A DNS record contains nothing from which a deliverability score could be computed, and a number backed by no measurement only serves to impress. We would rather show what we read.
I have just published my records and they are not showing.: DNS takes time to propagate — from a few minutes to a few hours, depending on your host and the declared time to live. Wait, then read again.

Going further

Set up your domainThe exact path at your own host, tab by tab, with the pitfall specific to each.Landing in the inboxWhat happens after authentication: reputation, complaints, dead addresses.SPF, DKIM, DMARCThe short definition, if you only wanted to know what these three acronyms mean.

What if your sending were authenticated from the start?

Plumail is a European email marketing tool. It gives you the exact values to publish for your domain, and checks that they answer before your first send.

Create a free account

No credit card.