Email DNS checker

Check a domain's MX, SPF, DMARC and DKIM records, see what each part means, and catch the mistakes that let forged mail through or send real mail to spam.

The selector is the s= value in the DKIM-Signature header of an email from the domain. The common ones (default, google, selector1, selector2, k1 and mail) are always tried too.

Pressing Look up sends the domain you enter, and names under it such as _dmarc.example.com, to Cloudflare's public DNS resolver, or to Google's if you pick it or Cloudflare doesn't answer. Nothing is sent before you press it.

This page reads public DNS records over DNS-over-HTTPS. When you press Look up, it sends the domain you entered to Cloudflare (cloudflare-dns.com) or, if you choose it or Cloudflare doesn't answer, to Google Public DNS (dns.google), along with the names it needs to check: _dmarc and the DKIM selectors under your domain, the domains your SPF record includes, and the report addresses your DMARC record names. Like any website, the resolver also sees your IP address; nothing else is sent, and nothing is stored here. The checks follow RFC 7208 (SPF), RFC 7489 (DMARC) and RFC 6376 (DKIM). A DKIM selector can be any name, so not finding one of the common ones doesn't mean the domain has no DKIM. Answers come from the resolver's cache, so a record you have just changed can show its old value until its TTL runs out.