My domain has all three. Why does mail still go to spam?

Authentication proves a message is really from you; it says nothing about whether people want it. Reputation, complaint rates, list hygiene and content all still apply. What these records do is make sure the reputation being judged is yours and not a spoofer's.

Should I use ~all or -all in SPF?

Start with ~all, which asks receivers to treat unlisted senders as suspicious rather than rejecting them. Move to -all once your DMARC reports show every legitimate sender is listed, because -all will hard fail anything you have forgotten.

What does p=none actually do?

Nothing to the mail. It asks receivers to send reports and to treat failing mail as they would have anyway. It is the right first step and a bad resting place, since a domain on p=none can still be spoofed freely.

How do I find my DKIM selector?

Send yourself a message, open its original headers, and look at the DKIM-Signature line. The s= value is the selector. In Gmail that is Show original; in Outlook, View message source.

Can two SPF records be combined?

They have to be. A domain may publish exactly one SPF record, and two makes both invalid. Merge the mechanisms from each into a single v=spf1 record, minding the ten-lookup limit as you do it.

SPF, DKIM and DMARC Checker

Reads all three records for a domain and says what they actually do: how many DNS lookups the SPF record needs, what the DMARC policy asks receivers to do, and how big the DKIM key is.

The domain you type is sent to Cloudflare or Google's public resolver to read its TXT records. Nothing is stored here and nothing else leaves your browser.

How to use SPF, DKIM and DMARC Checker

1Type the domain your mail comes from.
2Add a DKIM selector if you know it, or leave it empty to try the common ones.
3Press check.
4Read each record, and what is worth fixing about it.

What the three records do

SPF lists the servers allowed to send for your domain. DKIM is a signature on each message that receivers verify with a key published in DNS. DMARC ties them together: it tells receivers what to do when both fail, and asks for reports about who is sending as you.

Mail passes DMARC when either SPF or DKIM passes and the passing one is aligned with the From address. That word alignment is why mail sent through a marketing platform can pass SPF and still fail DMARC: the SPF check passed for the platform's own domain rather than yours.

The limit of ten lookups

An SPF record may trigger at most ten DNS lookups while it is evaluated, counting every include, a, mx, exists and redirect, including the ones inside the records you include. Past ten, evaluation stops and the result is a permanent error, which most receivers treat as having no SPF at all.

It is the most common way a working SPF record quietly stops working: nothing on your side changed, and a provider you include added one more include to theirs. The count here is what your own record costs. The ones nested inside an include need checking at the provider.

Why DKIM needs a selector

A DKIM key lives at a name like google._domainkey.example.com, where google is the selector. Nothing in DNS lists which selectors a domain uses, so the only way to find one is to be told it or to guess.

With the field left empty, the common selectors for Google Workspace, Microsoft 365, Mailchimp, SendGrid, Zoho and others are tried. Finding nothing proves nothing: your selector could be anything, and the reliable way to find it is to open a message you have sent and read the s= value in its DKIM-Signature header.

Limits

Lookups inside an include are not followed, so the SPF count here is your own record's and not the full total.
DKIM selectors can be named anything. Finding none does not mean a domain has no DKIM.
No test message is sent, so alignment and the real pass or fail of a given message are not checked here.
A BIMI record, which some inboxes use to show a logo, is not read.

Frequently asked questions

My domain has all three. Why does mail still go to spam?: Authentication proves a message is really from you; it says nothing about whether people want it. Reputation, complaint rates, list hygiene and content all still apply. What these records do is make sure the reputation being judged is yours and not a spoofer's.
Should I use ~all or -all in SPF?: Start with ~all, which asks receivers to treat unlisted senders as suspicious rather than rejecting them. Move to -all once your DMARC reports show every legitimate sender is listed, because -all will hard fail anything you have forgotten.
What does p=none actually do?: Nothing to the mail. It asks receivers to send reports and to treat failing mail as they would have anyway. It is the right first step and a bad resting place, since a domain on p=none can still be spoofed freely.
How do I find my DKIM selector?: Send yourself a message, open its original headers, and look at the DKIM-Signature line. The s= value is the selector. In Gmail that is Show original; in Outlook, View message source.
Can two SPF records be combined?: They have to be. A domain may publish exactly one SPF record, and two makes both invalid. Merge the mechanisms from each into a single v=spf1 record, minding the ten-lookup limit as you do it.