Paste up to 200 domains, or load a CSV, and get SPF, DMARC, MX and DKIM for every one of them in a single pass. Recursive SPF lookup counting, mail provider detection, a PDF report, a results CSV and the exact DNS lines to paste.
Email addresses and full URLs are fine, the domain is pulled out of them. Duplicates are dropped.
Read in this tab. The file is never uploaded.
| Score | Domain | Mail provider | SPF | Lookups | DMARC | DKIM | Top problem |
|---|
Tap any row to open the full record for that domain, the issues found, and the DNS lines to paste.
Two jobs. The first is a preflight on your own sending domains before a campaign goes out, because a broken SPF record or a missing DMARC policy is the quietest way to lose a month of email: nothing bounces loudly, the mail simply stops reaching inboxes. The second is bulk enrichment. Run a prospect list through it and every row comes back with the mail provider that domain actually uses, which is real segmentation data you would otherwise pay for.
SPF allows ten DNS lookups per evaluation. Go over and the record is a permanent error, which most receivers treat as no SPF at all. Counting them properly means following every include and every redirect down the chain, because the ten is a total across the whole tree, not a count of the terms in your own record. A flat parser reports zero lookups for a record like v=spf1 redirect=_hspf.hubspot.com and calls it unqualified, when in truth it redirects to a record that includes another record and finishes with a hard fail. This page walks the chain, with a cycle check on the current branch so a loop cannot hang it, and shows what each top level include costs so you know which one to cut.
SPF says which servers may send as your domain. The qualifier on the all term at the end is the whole point of the record: -all is a hard fail and is stricter, ~all is a soft fail and is the usual safe choice, while ?all and +all tell the world that anyone may forge your domain. Two SPF records on one domain is a hard failure, not a redundancy, so merge them into one.
DMARC tells receivers what to do when a message fails both SPF and DKIM alignment, and where to send the reports. Start at p=none with a reports address, read the reports for a few weeks, then move up. Google and Yahoo require a DMARC record for bulk senders, and p=none satisfies that requirement while protecting nothing on its own.
DKIM is reported as found or not found, and nothing stronger than that, on purpose. DKIM keys live at a selector name you chose, and there is no way to list them from outside. This page probes the selectors the common providers use. Amazon SES, Mailgun, Postmark, Brevo and Klaviyo hand out random or account specific selectors, so a domain can be signing perfectly and still show as not found here. Treat a hit as proof it works and a miss as unknown.
Two hundred domains per run. The count of DNS lookups is exact for include and redirect chains, which are the only terms that can nest; the a, mx, ptr and exists terms each cost one and are counted without being resolved. Results come from a public recursive resolver, so a record changed in the last few minutes may still be cached. This tool reads DNS only. It does not ingest DMARC aggregate reports, does not test a real send, and cannot tell you whether a given mailbox provider puts you in the inbox or the promotions tab, because nothing that reads DNS can.