To check email DNS records for your domain, type it into the DNS & Email Checker. Bloghints' server looks up the domain and reports its SPF, DKIM and DMARC records, its MX mail servers, nameservers, A and AAAA addresses and CAA records. Every problem comes with a plain fix, often with the exact record to add.
Why does my email land in spam?
Gmail, Yahoo and other mailbox providers look up records in your domain's DNS, the public address book of the internet, to tell real mail from forgeries. If those records are missing or wrong, your newsletter, contact form replies or shop receipts can land in spam or bounce.
Three records do most of the work:
- SPF (Sender Policy Framework) lists the servers that may send mail for your domain.
- DKIM (DomainKeys Identified Mail) adds a digital signature to each message. The public key sits in your DNS, so receivers can check the signature.
- DMARC tells receivers what to do when a message fails those checks, and where to send reports about it.
Big mailbox providers now ask bulk senders to set up all three. Google draws the line at more than 5,000 messages a day to Gmail accounts, and it asks every sender for at least SPF or DKIM. Yahoo asks bulk senders for SPF, DKIM and a DMARC policy too.
What the DNS & Email Checker reports
The checker reads your domain's public DNS records and compares them with the rules in the standards.
| Record | What the checker looks at |
|---|---|
| SPF | One record only, the DNS lookups it needs against the limit of 10, the ending (~all, -all, ?all or +all) and every include |
| DMARC | The record at _dmarc, its policy (none, quarantine or reject), pct, report address (rua) and alignment |
| DKIM | Common selectors such as google, default, selector1, selector2, k1, s1 and s2, plus one you type, with the key length when it can be read |
| MX | Your mail servers with their priority, a null MX, and MX records that point to an IP address or a CNAME |
| Nameservers | The servers that answer for your domain |
| A and AAAA | The IPv4 and IPv6 addresses of the domain |
| CAA | Which certificate authorities may issue SSL certificates for it |
You can enter several domains, one per line, and export the results as a CSV file.
How do you check email DNS records?
- Type your domain without https:// or a path, for example
example.com. - Add your DKIM selector if you know it. You find it in the
s=part of the DKIM-Signature header of a message you sent. - Run the check and read the red rows first. They are errors that can stop mail from passing.
- Copy the suggested record into the DNS zone at your domain registrar or host, then check again.
How to fix SPF problems
SPF lives in a TXT record that starts with v=spf1. Our guide on what an SPF record is explains each part in more detail.
More than one SPF record
A domain may have only one SPF record. With two, SPF fails with an error. Merge them into one line, for example v=spf1 include:_spf.google.com include:mail.example-sender.com ~all, and delete the old records.
Too many DNS lookups
Each include, a, mx, exists and redirect part makes the receiver do another DNS lookup. The SPF standard, RFC 7208, stops at 10, and above that SPF fails. Remove services you no longer use.
The wrong ending
The last part tells receivers what to do with mail from servers that are not on your list. -all means fail it, and ~all means accept it but treat it as suspect. ?all gives no opinion, and +all lets anyone send as you, so never use it. Start with ~all and move to -all once you are sure every real sender is listed.
How to fix DMARC and DKIM problems
No DMARC record
Add a TXT record with the name _dmarc and a value such as v=DMARC1; p=none; rua=mailto:dmarc@example.com. The policy none only watches. The rua address gets regular reports that show who sends mail with your domain. When all your real mail passes, move to p=quarantine and later to p=reject.
pct and alignment
The pct tag applies the policy to only part of your mail. The newer DMARC standard, RFC 9989, no longer uses pct, so do not rely on it. Alignment means the domain in the From line must match the domain that SPF or DKIM checked. If your newsletter service signs mail with its own domain, set up custom DKIM with your domain in its panel.
No DKIM key found
DKIM keys live at a name like selector._domainkey.example.com. DNS has no way to list every selector, so the checker tries the common ones and the one you type. If it still finds nothing, turn on DKIM in your mail provider's panel and add the TXT or CNAME record it gives you. Google asks for keys of at least 1,024 bits and suggests 2,048.
MX, nameservers, A records and CAA
MX records say where to deliver mail for your domain. The lowest priority number is tried first. Three MX problems get flagged:
- MX points to an IP address. An MX record must name a host, such as
mail.example.com, which then has its own A record. - MX points to a CNAME. The standards do not allow this. Point it to the real host name your mail provider gives you.
- Null MX. A single MX record of
0 .means the domain takes no mail at all. If you expect mail, replace it with your provider's MX records.
The nameservers show who really runs your DNS. If they are not the ones you expect, records you add in your hosting panel do nothing. Our guides on pointing a domain to hosting and domain name vs web hosting explain how these parts fit together.
CAA records list the certificate authorities that may issue SSL certificates for your domain. If yours leaves out the company your host uses, renewals fail. Add a line such as 0 issue "letsencrypt.org", then test the certificate with the SSL Checker.
Run this tool again whenever you add a newsletter service, change mail providers or move to a new host. Check email DNS records after each change, fix the red rows first, and your messages have a much better chance of reaching the inbox.
Frequently asked questions
Do I need DMARC if I only send a few emails?
The strict rules from Google and Yahoo are for bulk senders, but a DMARC record still helps a small site. It tells receivers how to treat fake mail sent in your name. Starting with p=none and a report address carries no risk to your real mail.
Why does the checker not find my DKIM key?
DKIM keys sit under a selector name, and DNS cannot list them all. The checker tries the most common selectors and the one you type. Look for s= in the DKIM-Signature header of a message you sent, enter that selector and check again.
Should my SPF record end in ~all or -all?
Use ~all while you are still finding every service that sends mail for you. Once your DMARC reports show that all real mail passes, you can switch to -all. Never use +all, because it lets anyone send mail as your domain.
