Free tool · Email
Emails landing in spam? Enter your domain: we read its setup and explain what works, what doesn't and how to fix it.
Email was invented when everyone trusted everyone: anybody can write “From: you@your-domain.com” on an envelope. These three settings, published in your domain's DNS, let receiving servers check that a message really comes from you.
The list of authorized mail carriers. You publish which servers may send email for your domain: your mailbox provider, your newsletter tool, your invoicing software.
Limit: SPF checks the message's technical envelope, not the address the recipient sees. And it breaks when a message is forwarded.
The wax seal. Every message leaves with an encrypted signature; the key to verify it is published in your DNS. If someone alters the message on the way, the seal breaks.
Every service sending on your behalf needs its own key, identified by a “selector”.
The instructions for the post office. They say what to do with a message that claims to be from you but fails SPF and DKIM: let it through, send it to spam, or reject it.
As a bonus, major providers send you a daily report of everything that went out under your name.
The key point, often misunderstood: DMARC requires alignment. It isn't enough for SPF or DKIM to pass; they must pass for the same domain shown in the “From:”. A newsletter signed with its provider's domain instead of yours passes DKIM… but fails DMARC.
Since February 2024, Gmail and Yahoo reject or send to spam messages from poorly configured domains. Microsoft (Outlook, Hotmail) has applied similar rules to bulk senders since May 2025. Small organizations are affected too: a newsletter to 800 members, donation receipts, a website's automatic notices.
p=noneEven below those volumes, setting everything up is the best delivery insurance: filters treat a clearly identified domain better.
~all.p=none with a rua= address to receive reports.p=quarantine, then p=reject once everything passes. Your name is then protected against phishing.A new service says “add this SPF”, and it gets added next to the old one. With two SPF records, both are invalid. They must be merged into one.
Each include: often hides others. You go over the limit without noticing, and the whole SPF fails. Our counter does the math for you.
A WordPress site sending “From: info@your-domain.com” from its host, without the host being in SPF or signing with DKIM: contact or order messages land in spam. The fix is an authenticated SMTP relay, or adding the host to SPF with a DKIM key.
DMARC in monitoring mode meets the requirements but protects nothing. Fraudsters can keep writing to your members or customers in your name.
Still accepted, but no longer the recommendation. Use a key rotation to move to 2048 bits.
Unlike SPF and DMARC, which live at fixed addresses, a DKIM key is published under a name each service picks. We try the most common ones, but yours may differ. To find it:
DKIM-Signature line. The selector is the s= value, the domain the d= value. For example d=example.com; s=k1;.If d= isn't your domain (say d=mcsv.net), the service signs with its own domain: DKIM passes, but DMARC alignment doesn't. Look in its settings for an “authenticate your domain” option.
SPF, DKIM and DMARC prove you are who you say; they don't say whether your messages are wanted. The reputation of the domain and sending servers weighs heavily: a domain once used for spam (or hacked) can stay penalized for months. Content, links, complaints and sudden volume spikes matter too. For Gmail, the free Google Postmaster Tools shows your domain's reputation.
With DMARC in place, both work: the DMARC policy decides what happens to messages. ~all is more forgiving of forwarded mail (a message redirected by another mailbox fails SPF). -all is stricter. Start with ~all, move to -all if you like, once everything is checked.
Yes, and that's where it's simplest: v=spf1 -all for SPF and v=DMARC1; p=reject for DMARC. Fraudsters love dormant domains, because nobody watches them.
For DMARC, yes: without its own record, a subdomain follows the main domain's (its sp= value, or p=). For SPF and DKIM, no: each sending subdomain needs its own.
Often a few minutes, sometimes a few hours, depending on the record's time to live (TTL). If our tool still shows the old version, try again a little later.
Nothing: the check runs live, and the result isn't stored. We only keep, for at most two hours, an encrypted fingerprint of your IP address to limit abuse. Details in our privacy policy (in French).
Your cookies
With your consent, Google Analytics counts visits to this site (_ga cookies, 2 years). Google processes these measurements, including outside Canada. Nothing loads until you say yes. Learn more (French)