hollop.net

SPF, DMARC & DKIM Checker

Check whether your domain is set up correctly for sending email, and create the matching DNS records. With clear explanations instead of jargon.

Generators run locally in your browserFollows nested SPF includesFree, no sign-up
Specify DKIM selectors

If left empty, common selectors are tried. You can find the right one in the header of a sent email under DKIM-Signature at s=.

Domains to try:

Enter a domain and click “Check”.

For the check, hollop.net looks up the domain’s public DNS records. Nothing is stored.

Understanding SPF, DKIM and DMARC

Since Google, Yahoo and Microsoft introduced stricter sender requirements, emails without correct SPF, DKIM and DMARC records quickly land in spam or get rejected. The three mechanisms work together and are all published as TXT records in the sending domain’s DNS.

SPF: who may send for the domain?

The SPF record (Sender Policy Framework) on the domain itself lists the servers allowed to send mail for it. The receiver compares the IP address of the delivering server with this list.

example.com.  TXT  "v=spf1 mx include:spf.protection.outlook.com ~all"

DKIM: is the message unaltered?

With DKIM (DomainKeys Identified Mail) the mail server signs every outgoing message with a private key. You publish the matching public key at selector._domainkey.example.com. Selectors let a domain run several keys in parallel, for example one per service. RSA keys with 2048 bits are recommended.

DMARC: what happens on failure?

DMARC ties SPF and DKIM to the visible From address and defines what happens to messages that pass neither check aligned with the sender domain. The record lives at _dmarc.example.com.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

Recommended order

  1. Set up SPF with all legitimate sending paths and ~all.
  2. Enable DKIM for every service that sends on your behalf.
  3. Start DMARC with p=none and rua, and review the reports for a few weeks.
  4. Once all legitimate mail passes, switch to p=quarantine and later p=reject.

Protect domains that send no email

Domains that never send email should be protected against abuse too: v=spf1 -all as SPF, v=DMARC1; p=reject as DMARC and optionally a null MX (MX 0 .).

FAQ

Why does my mail land in spam despite SPF?

SPF alone is no longer enough for large providers. Gmail, Yahoo and Outlook also expect a valid DKIM signature and a DMARC record. SPF or DKIM must also match the domain in the visible From address.

What does “too many DNS lookups” mean for SPF?

An SPF record may trigger at most 10 DNS lookups during evaluation, nested includes included. If the limit is exceeded, SPF fails completely. Fix: remove includes you no longer use, or list fixed IP ranges with ip4/ip6.

How do I find my DKIM selector?

Open the source of an email sent through the service and look for the DKIM-Signature header. The value after s= is the selector, the one after d= the signing domain. Microsoft 365 uses selector1 and selector2, Google Workspace uses google by default.

Should I use -all or ~all?

With DMARC in place, ~all is usually enough because DMARC makes the actual decision. -all is stricter and makes sense when you are sure you know every sending path. For domains that send no email, always use -all.

Is my data stored?

No. The SPF, DMARC and DKIM generators run entirely in your browser; even the private DKIM key is created only there. For the check, hollop.net looks up public DNS records and stores nothing.