Skip to main content

SPF, DKIM and DMARC Checker

Enter a domain to check the three records that decide whether Gmail, Outlook and other providers trust its email. The checker reads the records live, counts SPF DNS lookups against the limit of 10, checks the DMARC policy and looks for the Google Workspace DKIM key. Each result explains what to change. For the full setup, see our Google Workspace email authentication guide.

One click checks MX, SPF, DKIM and DMARC for the domain.

Google Workspace uses the selector google unless your admin chose another one in Admin console > Apps > Google Workspace > Gmail > Authenticate email.

What the checker looks at

  • MX: whether the domain receives mail through Google Workspace.
  • SPF: that there is exactly one record, that it includes _spf.google.com when Gmail sends for the domain, how it ends (~all or -all), and how many DNS lookups it needs. More than 10 lookups makes SPF fail.
  • DKIM: that a public key is published at the selector you enter, and whether it is 2048-bit.
  • DMARC: that a record exists, its policy (none, quarantine or reject), whether aggregate reports are requested, and the percentage of mail it applies to.

How to fix the most common results

SPF: missing

Add one TXT record at the domain root. For a domain that sends only through Google Workspace: v=spf1 include:_spf.google.com ~all. Add an include: for every other service that sends as your domain, such as a newsletter or ticketing tool.

SPF: multiple records

A domain may publish only one SPF record. Merge every include: and ip4: into a single record and delete the others, otherwise SPF fails for all mail.

SPF: more than 10 DNS lookups

Each include:, a, mx and redirect counts, including the ones inside included records. Remove services you no longer use, or replace an include with the sender's fixed ip4: ranges if they publish them.

DKIM: not found

In the Google Admin console go to Apps > Google Workspace > Gmail > Authenticate email, generate a 2048-bit key, publish the TXT record at google._domainkey, wait for DNS, then click Start authentication. New domains can wait 24 to 72 hours before a key can be generated.

DMARC: missing or p=none

Start with v=DMARC1; p=none; rua=mailto:your-reports-address to collect reports, fix any legitimate senders that fail, then move to p=quarantine and finally p=reject. The email authentication guide walks through each stage.

Privacy

Lookups run in your browser against Google Public DNS. The domain you enter is not sent to or stored by Workspace Blog.

Records changed recently can take up to 48 hours to show everywhere. For the step-by-step fixes, rollout order and how to read DMARC reports, read the email authentication guide.