MX lookup

Type a domain to see the mail servers that receive its e-mail, and whether its SPF, DMARC and DKIM records are set up so other providers trust its mail. Every record is explained in plain words, with what to fix.

The domain in the e-mail addresses, such as example.com. A pasted address or URL works too. Find it as s= in the DKIM-Signature header of a mail from this domain. Left empty, a few common selectors are tried.
Mail setup Enter a domain and press Check to see its mail servers and its SPF, DMARC and DKIM records.

Running a mail server of your own on a VPS? It needs outgoing port 25 open and an IP address that is not on blocklists, and reverse DNS for that address set to the server's name. Ask a provider about port 25 before you order. From €4.46 a month today, among 2,132 servers.

Compare small VPS plans Look up all records

The domain you check goes to our server and from there to Cloudflare's public resolver (1.1.1.1) over HTTPS. Its mail servers are never contacted, and we do not store the domain.

How the check works

Our server asks Cloudflare's public resolver for the domain's MX and TXT records, the TXT record at _dmarc, DKIM keys, the addresses of the first six mail servers, and the SPF records of every include, up to 20 of them. It never connects to the mail servers. Each record is then read by the rules of its standard: SPF (RFC 7208), DMARC (RFC 7489) and DKIM (RFC 6376).

SPF says which servers may send, DKIM signs each message, and DMARC ties the two to the address people see in the From line and tells receivers what to do when both fail. Big mailbox providers check all three, so mail from a domain without them often lands in spam.

Example

A shop at example.com sends mail through Google Workspace and a newsletter service. Its SPF record is "v=spf1 include:_spf.google.com include:servers.mcsv.net ~all": two includes, each a DNS lookup, plus what they include, well under 10. Its DMARC record is "v=DMARC1; p=none; rua=mailto:[email protected]", so reports arrive but forged mail is still delivered. After a few weeks of reports showing only its own mail, the shop changes p=none to p=quarantine.

Questions

What is an MX record?

An MX record names a server that receives e-mail for a domain, with a priority number. Senders try the lowest number first. A domain can have several MX records for backup or to share the load; without any, senders try the domain's own address.

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send for a domain. DKIM adds a signature to each message that receivers check with a public key in DNS. DMARC requires that at least one of them passes for the domain in the From address, and says what receivers should do with mail that fails: nothing, spam folder or reject.

What does p=none mean in DMARC?

p=none means monitor only: receivers send reports to the rua address but deliver failing mail as usual. It is the right first step, so you can see which services send mail as your domain. Move to p=quarantine and then p=reject once the reports show your own mail passes.

What is the SPF 10 DNS lookup limit?

Checking an SPF record may cost at most 10 DNS lookups. Each include, a, mx, ptr, exists and redirect counts as one, including those inside included records. Above 10, receivers stop with a permanent error and SPF fails for all your mail. Remove includes you no longer use, or replace one with the ip4 and ip6 ranges it stands for.

Should SPF end in ~all or -all?

Both protect the domain. -all tells receivers to fail mail from servers not listed; ~all tells them to accept it but treat it as suspicious. With DMARC in place, receivers follow the DMARC policy either way, so ~all is the common choice; -all suits a domain that sends no mail at all.