Free DMARC checker: is your domain ready to send?
Free DMARC checker that also tests SPF, DKIM and MX. See in seconds whether Gmail and Outlook can trust your domain, and what to fix. No account needed.
Type your domain or email address, and this free DMARC checker tells you whether inboxes like Gmail and Outlook can trust email from your domain, and what to fix if they can't. It checks four public settings in a few seconds, and you don't need an account.
Why inboxes check your domain
Anyone can type your company's name into the "From" line of an email, and scammers do it every day. So before Gmail or Outlook delivers an email, it checks whether the email really came from you.
Think of a courier checking the sender's ID before accepting a parcel. Your domain, the part of your email address after the @, publishes a few public settings that work as that ID: who may send email for you, a signature that proves it, and what to do with fakes.
Without them, your email is more likely to land in spam or be turned away. Google says unauthenticated messages "might be marked as spam or rejected". That matters most in cold email, because the people you write to have never heard from you.
What the DMARC checker looks at
| Setting | What it does for you | What good looks like |
|---|---|---|
| MX | Tells the world where replies to your domain should go. Without it, people can't answer you. | "Receives email", with your email provider's servers listed |
| SPF | A public list of the services allowed to send email as your domain. Inboxes compare each email against it. | "SPF is set up", with one record that includes the service you send through |
| DKIM | A signature your email provider adds to each email, so inboxes can confirm it came from your domain. | "DKIM signing is set up", with the name it was found under |
| DMARC | Your instruction to inboxes for emails that fail the two checks above: do nothing for now, send to spam, or reject. | Any DMARC record. p=none means "do nothing, just watch", and that's fine to start with. |
How to read your result
Each check gets one of three labels:
- OK: nothing to do.
- Check: worth a look. Usually something inboxes like to see is missing, such as a DMARC record.
- Fix: something is broken, such as no SPF record or two of them. Fix these first.
Under each problem, the checker says what to change, often with the exact text to add. The top line names your email provider when the checker recognizes it. "Filtered by" means your email passes through that security service first.
What an OK can't tell you
The checker reads your public settings, not your emails, so it can't see whether an email you really sent passed. To test one, send it to a Gmail address that isn't yours and open it there. Click More (the three dots next to Reply), then Show original, and look for spf=pass, dkim=pass and dmarc=pass.
Where to find your DKIM selector
DKIM is the one check that may need a hint from you. Your email provider files its DKIM key under a name called a selector, and the checker has to guess that name. It tries the usual ones, so most people can leave the field empty.
If you see "No DKIM key found", find your selector:
- Send an email from your domain to a Gmail address you can open.
- In Gmail, open it, click More (the three dots next to Reply), then Show original.
- Find the line that starts with
DKIM-Signature. The word afters=is your selector: ins=google, the selector isgoogle.
Then click Know your DKIM selector? Add it in the checker, type it in and check again.
If there's no DKIM-Signature line, or the d= in it isn't your domain, DKIM isn't on for your domain yet.
| Email provider | Usual selector |
|---|---|
| Google Workspace | google |
| Microsoft 365 | selector1 and selector2 |
| Fastmail | fm1, fm2 and fm3 |
How to fix a problem
Every fix is a change to your domain's public settings, called DNS. They live where you bought your domain or where it's hosted. If someone else manages your website or email, send them the checker's suggestion as it is.
Our guide to SPF, DKIM and DMARC has the exact steps for Google Workspace and Microsoft 365.
After a change, wait and check again. Google says a new SPF or DKIM record can take "up to 48 hours" to work, and the checker remembers each result for an hour.
How Coldoutbound helps
Coldoutbound runs this same check on every mailbox you connect and shows it on the mailbox's page, so you see a problem before you start sending. The checker here is free.
Read more: Gmail's sender guidelines, Google on setting up DKIM, Google on setting up DMARC, Microsoft on setting up DKIM.
Questions
Is p=none enough?
To start, yes. It tells inboxes to take no action while you confirm your real emails pass, and Google and Yahoo both accept it from bulk senders. Google recommends moving to quarantine or reject over time.
Does a subdomain need its own DMARC?
No. If news.example.com has no DMARC record of its own, the one on example.com covers it, and the checker shows which one it used. SPF is different, so each subdomain that sends needs its own SPF record.
Does it check blocklists?
No. It only reads your domain's public settings.
Can I check someone else's domain?
Yes. These settings are public, so you can check any domain, up to 10 a minute and 100 a day.
Do you keep what I check?
Your check isn't linked to an account. Like most websites, our server logs each request, including your IP address and the domain you checked. We also keep each result for an hour, so repeat checks are quick.