SPF, DKIM and DMARC checker

Check your domain's SPF, DKIM, DMARC and MX for free, with a 0 to 100 score, what to fix in plain words and the record ready to copy.

What the checker looks at#

Type the domain (or paste the site address, or an email) and the tool reads DNS live:

MX: whether the domain receives email and through which provider (Google Workspace, Microsoft 365, Zoho and others).
SPF: whether there is a single v=spf1 record, how it ends (~all, -all or the dangerous +all) and how many DNS lookups it costs. The limit is 10: above it SPF fails for everyone, and almost nobody notices.
DKIM: we look for the key on the most common selectors (google, selector1, selector2, k1, s1, default and others). If you send through a service with its own selector, enter it in the optional field.
DMARC: whether it exists, which policy it uses (none, quarantine or reject) and whether reports go somewhere (rua).
MTA-STS, TLS-RPT and BIMI: optional extras for security and the logo in the inbox.

The result comes with a 0 to 100 score. SPF, DKIM and DMARC weigh the most, because they are what Gmail, Yahoo and Microsoft require.

How to read each item#

Color	What it means
Green	right
Yellow	works, but has a risk or a missing step
Red	wrong or missing, and it hurts delivery
Gray	optional, worth doing after the rest

Every item that needs a fix comes with a plain explanation and, when possible, a record ready to copy into your DNS panel.

The most common mistakes (and the fix)#

Two SPF records. Every new service says "add this SPF" and the domain ends up with two. Only one is allowed. Merge them into a single v=spf1 with all the includes, ending in ~all.
SPF over 10 lookups. Every include counts, and the nested ones too. Remove services you no longer use.
No DMARC. Gmail and Yahoo require DMARC from bulk senders since 2024, Microsoft since 2025. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, read the reports and move to quarantine and reject once everything aligns. The step by step is in DMARC from p=none to p=reject.
DKIM not turned on. DKIM is the email's signature. Every service sending for your domain needs its own key published in DNS; turn it on in the service's dashboard.
SPF ending in +all. It lets any server in the world send as you. Change it to ~all.

If your domain does not verify at a sending service, see Email domain verification failed.

On the API and MCP#

The same check is on the API, no key needed:

Terminal

curl "https://api.couryo.com/v1/tools/check-domain?domain=yourdomain.com"

Without a key you get 20 domain checks a day per IP; with any Couryo key, 300 a day. The fields are in the free tools docs. On the public MCP server, no login (https://mcp.couryo.com/tools), the tool is check_domain_dns.

FAQ#

Why does my DKIM show as not found?#

DKIM lives at a name that depends on the selector (selector._domainkey.yourdomain.com), and every service uses its own. We try the most common ones. If yours is not among them, open an email you sent, find the DKIM-Signature header and enter the s= value in the selector field.

I changed my DNS and the result did not change. Now what?#

DNS takes from minutes to a few hours to update, and the result is cached here for 10 minutes. Wait a little and check again.

Do I need SPF if I use a sending service?#

It depends on how the service sends. At Couryo, the SPF that counts is the return path's (a subdomain we keep), so your root domain does not change. At other services, your root SPF needs their include.

What is a good score?#

Above 75 (grade B) the basics are right. The top score needs DMARC at quarantine or reject and the extras (MTA-STS, TLS-RPT and BIMI).

My domain sends no email at all. Should I do anything?#

Yes: publish v=spf1 -all and a DMARC p=reject. That way nobody can use the domain for scams in your name.