Free tool
Three records decide what a mail server does with your emails. Enter your domain: we read them from public DNS, show you what they contain, and tell you what it means.
Read just now, as this page loaded. Nothing was stored.
What it says
An SPF record is published.
It ends with “~all”: servers not on the list still get through, but flagged as suspicious. This is the most common setting.
The record, as published
v=spf1 include:_cidrs.wikimedia.org ~allLocation queriedTXT wikipedia.org
What it says
None of the 35 common selectors we tried answers on this domain.
A DKIM selector is named by whoever sends your mail: unlike SPF and DMARC, it has no fixed location. Amazon SES, Postmark and HubSpot draw a random one per domain — no tool of this kind can see those. A DKIM that is not detected here is not proof of a missing DKIM.
default, dkim, mail, smtp, google, selector1, selector2, k1, k2, k3, mandrill, s1, s2, brevo1, brevo2, mailjet, zoho, zmail, protonmail, protonmail2, protonmail3, fm1, fm2, fm3, mxvault, cf2024-1, cf2024-2, pm, pm-bounces, ses, amazonses, zendesk1, zendesk2, hs1-, hs2-
No record
Location queriedTXT <selector>._domainkey.wikipedia.org
What to do about it
The key comes from the service that sends your email: it gives you a selector name and a value to publish as TXT or CNAME. There is nothing to invent, only to copy.
Read the step-by-step guideWhat it says
The policy is “p=reject”: you are asking for unauthenticated messages to be refused before they even arrive. This is the firmest setting.
An aggregate report address is declared (“rua”): someone receives the summary of what is being sent in your name.
The record, as published
v=DMARC1; p=reject; rua=mailto:[email protected];Location queriedTXT _dmarc.wikipedia.org
They do different jobs, and one does not replace another. It is their combination that lets a server decide.
SPF
A TXT record published at your domain root, listing the servers allowed to send on your behalf — yours, your business mailbox provider's, your email marketing tool's.
When a message shows up, the receiving server looks at where it actually came from and compares that to the list. The final mechanism — “-all”, “~all”, “?all” — says what to do with servers that are not on it.
DKIM
Your sending service signs each message with a private key. The matching public key is published in your DNS, at a location whose name — the selector — is chosen by that service.
The receiving server verifies the signature. If it is valid, the message was not altered in transit and does come from a service you authorised.
DMARC
A TXT record on “_dmarc.your-domain” that answers a question SPF and DKIM leave open: what do we do with a message that fails both?
It does a second thing, often forgotten: it collects reports. The address declared in “rua” receives a summary of everything sent in your name, including by servers you know nothing about.
It is the value after “p=”. Publishing DMARC protects nothing until you have left the first row of this table.
| Policy | What you ask for | What it protects |
|---|---|---|
p=none | Change nothing, but send me the reports. | Nothing. It is an observation stance, meant to be temporary. |
p=quarantine | Put unauthenticated messages in the spam folder. | Impersonation stops paying off: the message arrives, but in a folder nobody opens. |
p=reject | Refuse unauthenticated messages. | The message does not arrive at all. It is the only setting that truly closes the door. |
Plumail is a European email marketing tool. It gives you the exact values to publish for your domain, and checks that they answer before your first send.
Create a free accountNo credit card.