📧 Email Deliverability Checker
An email deliverability checker that looks up a domain's real SPF and DMARC DNS records, and checks common DKIM selectors, via DNS-over-HTTPS.
What Email Deliverability Checker Does
SPF, DKIM, and DMARC are the three DNS-published records that let a receiving mail server decide whether an email claiming to be from a domain is actually authorized by that domain. All three are standard, publicly documented internet protocols (RFC 7208, RFC 6376, and RFC 7489 respectively) — this tool reads the same public DNS records any mail server checks, using Cloudflare's DNS-over-HTTPS resolver, entirely client-side.
What this tool does not do — and cannot do without infrastructure this site does not have — is test actual inbox placement (whether a real test message lands in the inbox, spam folder, or gets blocked outright at Gmail, Outlook, etc.) or check IP/domain blocklists. Those require sending real test messages to real mailboxes and checking blocklist databases, which several dedicated SaaS tools already do. This tool is scoped honestly to the DNS-authentication slice of the problem.
How to Use Email Deliverability Checker
- Enter the sending domain (not a full email address)
- Click Check Records to query SPF, DMARC, and common DKIM selectors
- Review which records exist and copy the raw values to compare against your provider's setup instructions
How to Read Your Result
A missing record is not automatically a crisis
A domain with no outbound mail (a pure "do not reply" landing-page domain, for instance) may legitimately have no SPF record and still be fine — these records only matter for domains that actually send email. Context matters more than a blanket pass/fail.
DMARC policy strictness matters as much as its presence
A DMARC record can exist but be set to p=none, which only monitors and reports without actually blocking spoofed mail — many domains start there deliberately before tightening to p=quarantine or p=reject once they've confirmed their own legitimate mail streams all pass. This tool shows the raw record so that policy can be read directly.
These three records work together, not independently
SPF alone can be broken by email forwarding (a common false-fail). DKIM alone survives forwarding but says nothing about which servers may send. DMARC ties both together and tells receivers what to do when either check fails — a domain with only one or two of the three has a real, specific gap, not just a lower score.
Multiple email services often mean one shared SPF record
A business sending from Google Workspace, a marketing platform, and a CRM all needs those three services' SPF mechanisms combined into a single record — adding a new sending service without editing the existing SPF record (rather than replacing it) is one of the most common real-world misconfigurations this kind of check surfaces.
Limitations & Accuracy Notes
- DKIM cannot be discovered without knowing the exact selector — this tool checks several common selector names, so "not found" for DKIM is inconclusive, not a confirmed failure.
- Does not test actual inbox placement, spam scoring, or blocklist status — only whether the authentication DNS records exist and what they say.
- DNS results can be cached; a very recently changed record may not reflect immediately depending on TTL and resolver caching.