Free SPF · DKIM · DMARC · MX checker
Check your sending domain's DNS records in plain English
Type the domain you send cold email from. We read its public DNS records and tell you, in plain English, what’s right, what’s wrong and how to fix it.
Try: any domain you send from.
What the checker reads
SPF
Exactly one v=spf1 record, the 10-lookup limit counted through every nested include, void lookups, and how the record ends (+all, ?all, ~all, -all).
DKIM
Common selectors for Google Workspace, Microsoft 365, Zoho, SendGrid, Mailgun and more, or the one you type. Key length: under 1024 bits fails, 1024 warns, 2048 passes.
DMARC
Policy (none, quarantine, reject), report address, the RFC 9989 changes (pct removed, t=y, np=) and alignment modes.
MX
Whether the domain can receive replies and bounces.
MTA-STS and BIMI
Shown for information only. They don’t count toward the score.
Cold Email Deliverability Kit
Then fix it properly, once
A step-by-step members’ guide to setting up a sending domain for legitimate cold email, with provider-specific DNS cheat sheets, a setup checklist and a warm-up tracker. Dated, sourced and updated for 12 months.
SPF without the 10-lookup trap
One record, the lookup limit, void lookups and how to end it.
DKIM keys and selectors
Finding your selector, 2048-bit keys and rotation.
DMARC and alignment
From p=none to reject, reports, and the RFC 9989 changes.
Gmail, Yahoo and Outlook.com rules
What every sender needs and what bulk senders need, from the providers’ own pages.
Setup by provider
Google Workspace, Microsoft 365 and other providers, record by record.
Warm-up, limits and list quality
Sending domains, a warm-up tracker, unsubscribe and complaint handling.
The guide’s pages
- Start here
- How inbox providers decide
- Gmail, Yahoo and Microsoft sender rules
- SPF
- DKIM
- DMARC and alignment
- Setup by provider
- Sending domains, inboxes and warm-up
- Unsubscribe and complaints
- List quality
- Cold email and the law
- Troubleshooting
- Setup checklist
- Sources
Questions
- What does the free checker check?
It reads your domain's public SPF, DKIM, DMARC and MX records, and shows MTA-STS and BIMI for information. For SPF it counts DNS lookups against the 10-lookup limit, checks there is exactly one record and reads how it ends. For DKIM it tries common selectors, or the one you type, and checks key length. For DMARC it reads the policy, the report address and the alignment settings.
- Does a clean result mean my email will reach the inbox?
No. Correct records are the minimum Gmail, Yahoo and Microsoft ask for. Inbox placement also depends on your list, your content, your volume and how recipients react, and nobody can guarantee it.
- How do I fix "SPF PermError: too many DNS lookups"?
Cut your SPF record to 10 DNS lookups or fewer, the limit in RFC 7208. Each
include,a,mx,ptr,existsandredirectcounts, including the ones nested inside other includes;ip4,ip6andalldon't. Remove includes for services you no longer use, or move a sending tool to its own subdomain with its own SPF record. The checker shows your current count.- Should my SPF record end in ~all or -all?
Either is fine.
~allmarks unlisted servers as suspicious;-allsays they aren't allowed, so use it once you're sure every service that sends as your domain is listed. Never use+all. Once DMARC is in place, your DMARC policy decides what receivers do with mail that fails.- Do I need DMARC to send cold email?
If you send about 5,000 or more emails a day to Gmail or Outlook.com addresses, yes: both require a DMARC record of at least
p=none, and Yahoo requires one from bulk senders. Below that it isn't required, but it is still worth publishing, because it tells receivers what to do with mail that fakes your domain and sends you reports.- How do I find my DKIM selector?
Open an email you sent, view its original headers and find the
s=value in theDKIM-Signatureheader; that is your selector. DNS can't list a domain's selectors, so a checker can only try common ones, and "not found" doesn't prove you have no DKIM.- Should I send cold email from my main domain or a separate one?
Many cold emailers use a separate domain, so outreach problems can't hurt the domain your customers and team rely on. That's common practice, not a provider rule. A subdomain of your main domain shares its reputation, and Gmail counts bulk volume across the whole domain, subdomains included. Each sending domain needs its own SPF, DKIM and DMARC.
- How many domains and inboxes do I need?
No provider sets a number. Spreading sending across several mailboxes keeps the volume from each one low, and each extra domain is more DNS to set up and watch. Start with what your planned daily volume needs, staying well under each provider's limits.
- How many cold emails a day can I safely send from one inbox?
No provider publishes a safe number for cold email. Google Workspace allows up to 2,000 messages a day per user, and Microsoft 365 allows 10,000 recipients a day per mailbox, but those are ceilings, not targets. Our suggestion: stay well below them, and slow down if bounces or spam complaints rise.
- How long should I warm up a new domain before sending?
No mailbox provider publishes a warm-up schedule. Google only says that raising volume too quickly can cause delivery problems, and Microsoft says to spread sends over time. Our suggestion is the ramp in our warm-up planner, which is labelled as a suggestion, not a rule. The planner also tracks bounces and complaints so you can see when to slow down.
- Do warm-up tools work?
We can't say for sure, and neither can the providers: none of them publishes anything about warm-up tools. A tool's warm-up score reflects how mail does inside its own network of inboxes, not how your real emails land. Our suggestion: check placement with test inboxes of your own at Gmail, Outlook and Yahoo.
- Google Workspace or Microsoft 365 for sending?
Either can work, and we don't know of any official source showing one delivers better. They have different sending limits and setup steps, and the kit covers both record by record. Microsoft requires both SPF and DKIM to pass for senders of more than 5,000 emails a day.
- How soon after adding DNS records can I start sending?
Set up SPF and DKIM at least 48 hours before you add DMARC, as Google's setup guide says. In Google Workspace you have to wait 24 to 72 hours after turning Gmail on before you can create a DKIM key. Run the checker to confirm the records are live, then start at a low volume and build up.
- What bounce rate is too high? Do I need to verify my list?
Keep bounces as low as you can, and verify any list you didn't build yourself before the first send. Amazon SES is the only provider we found that publishes a level: it reviews accounts at 5% bounces and may pause sending at 10%. Gmail, Microsoft and Yahoo publish no bounce level.
- Do you store the domains I check?
No. The domain is used for the live DNS lookup and then dropped. It isn't stored, logged or emailed, and the checker sets no cookies. We keep only an anonymous daily count of how many checks ran.
- What do I get in the kit, and what does it cost?
A step-by-step members' guide to setting up a sending domain, with DNS steps for each major provider, a setup checklist (PDF) and a send-ramp and domain tracker (Excel and CSV). It costs ฿990 (about US$29), paid once, and includes free updates for 12 months.
- Is cold email legal?
It depends on where your recipients are, not where you are. B2B cold email is lawful in the US, and to UK companies, if you follow the opt-out rules; it's risky in Germany and Canada without consent or an existing relationship. The kit has a plain-English page on the US, UK, EU, Canada and Thailand. This is general information, not legal advice.
- How do I sign in after buying?
With your email. We send a one-time sign-in link to the address you bought with; there's no password.
- Can I get a refund?
Only for a broken file or access, a duplicate purchase or a payment error. There is no money-back guarantee. See the refund policy.