Enter a domain. We read the live DNS records, show you what each one says, and name what's broken. No account.
Read from the TXT records at the domain you enter. SPF names the hosts allowed to
send mail using that domain as the envelope sender — the return-path and
the HELO name, not the From address a reader sees. That gap is why a message can
pass SPF and still be forged, and it is what DMARC alignment exists to close. If you
run a custom MAIL FROM domain on SES, the record receivers check is the one on that
subdomain, so check it here too. We report the record, name the sending platform
when we recognise it from the includes, and flag a ~all soft-fail
ending.
A public key published at <selector>._domainkey.yourdomain.com.
Your platform signs each message with the matching private key and receivers fetch
the key to check the signature held. Selectors are provider-specific — SES and
Microsoft 365 have you publish CNAMEs pointing into the provider, Google Workspace
gives you a TXT record to paste. Either way the selector is named in the signature
on each message, so a key that gets rotated or a CNAME that stops resolving fails
silently: mail still sends, it just stops being signed. We try the common selectors
automatically, or you can supply your own.
The TXT record at _dmarc.yourdomain.com. It ties SPF or DKIM to the
visible From domain and tells receivers what to do when neither passes with
alignment. Worth being precise about: DMARC passes if either mechanism
passes with alignment, so your policy only applies when both fail — which is why
forwarded mail that breaks SPF still gets through on its DKIM signature.
Where mail addressed to your domain is delivered, in priority order. Worth checking on a sending domain because replies, DMARC aggregate reports and anything a recipient sends back all need somewhere to land — and because a domain with no MX at all is a signal receivers notice.
Since February 2024, Google and Yahoo have required both SPF and DKIM, plus a published
DMARC record — p=none is enough — from bulk senders. Google defines a bulk
sender as one sending close to 5,000 messages in 24 hours to personal Gmail
addresses, counted across a primary domain; mail to Workspace accounts doesn't
count, and the classification is permanent once you cross it. Yahoo applies the same
authentication requirements but declines to publish a volume threshold. Microsoft
applied the same bar to outlook.com, hotmail.com and live.com in May 2025, and rejects
mail that fails it outright with 550 5.7.515.
The authentication half of those requirements is pass or fail on the records this page reads. The rest — complaint rates, unsubscribe headers, list hygiene — is not visible in DNS and needs your sending platform to answer.
And passing is not the same as reaching the inbox: authentication proves who sent a message, not whether anyone wants it. But failing it is the one deliverability problem with a definite fix. If a check above comes back red, start there.
Numonic monitors your domain around the clock — reputation, DMARC alignment, blocklists, and more. When something breaks, you'll know before your customers do.
Get Numonic →