By Ahmet Karaca · Updated · Checked against RFC 9989 (DMARC, May 2026), RFC 7208 (SPF), RFC 9990 (DMARC aggregate reports), RFC 8301 (DKIM key sizes) and RFC 7505 (null MX) on
What we check
One run looks up four kinds of DNS records for the domain you enter and turns them into nine checks. Each check ends as a pass, a warning or a fail, and the list next to the score uses the same names as the headings below.
DMARC
DMARC record published. We read the TXT record at _dmarc on your domain and, for a subdomain without one, on its organizational domain.
- Pass: a DMARC record we can parse was found.
- Fail: there is no DMARC record, or it cannot be parsed.
DMARC policy enforced. This looks at what receivers are asked to do with mail that fails.
- Pass: p=quarantine or p=reject applied to all failing mail: no t=y, and either no pct tag or pct=100.
- Warning: quarantine or reject in testing mode (t=y, or pct=0), or with a legacy pct from 1 to 99. RFC 9989 removed pct; receivers that follow it ignore the value, older ones may apply it to only part of the failing mail.
- Fail: p=none, or no DMARC record.
DMARC reports collected. Reports are how you find the senders you forgot.
- Pass: the record has at least one mailto: address in rua, and any address on another organization's domain has authorized it.
- Warning: an rua address on another domain has not published the _report._dmarc record that receivers look for, so they may drop those reports.
- Fail: no mailto: address in rua.
SPF
SPF record published. A TXT record starting with v=spf1 at the domain itself.
- Pass: the record exists.
- Fail: no SPF record was found.
SPF within lookup limits. We follow every include and count the DNS lookups a receiver would make.
- Pass: fewer than 9 lookups and no broken references.
- Warning: 9 or 10 lookups: still valid, but one more sender breaks it.
- Fail: more than 10 lookups, more than 2 lookups that return nothing, an include that points at a domain without SPF, an include loop, an mx term with more than 10 hosts, or no record.
SPF blocks unlisted servers. The ending decides what happens to servers you did not list.
- Pass: the record ends in -all or ~all, or hands off to another record with redirect=.
- Warning: it ends in ?all, or has neither an all nor a redirect, which leaves unlisted servers neutral.
- Fail: it ends in +all (or a bare all), which authorizes every server, or there is no record.
DKIM
DKIM key found. DNS has no way to list DKIM keys, so the health check probes a built-in list of selectors that common providers use, such as google, selector1 and selector2. Services that generate their own selector are only found when you enter it on the DKIM checker.
- Pass: at least one active key was found.
- Warning: no key under the selectors we tried. This is never a fail, because the key may sit under a selector we do not know.
DKIM key is strong. Key length follows RFC 8301, which requires at least 1024 bits and recommends 2048.
- Pass: no active RSA key is shorter than 2048 bits; Ed25519 keys always pass.
- Warning: an RSA key between 1024 and 2048 bits, or no key found to judge.
- Fail: an RSA key shorter than 1024 bits, which receivers must not accept.
MX
Receives email. Whether the domain says where its mail goes.
- Pass: MX records exist, or a null MX (RFC 7505) states that the domain takes no mail.
- Warning: no MX record at all.
How the score works
Every check has a fixed number of points, weighted by how much it protects the domain. A pass earns all of them, a warning 50%, and a fail none. The score is the sum, rounded to a whole number, out of 100.
| Check | Points | With a warning |
|---|---|---|
| DMARC record published | 20 | 10 |
| DMARC policy enforced | 15 | 7.5 |
| DMARC reports collected | 10 | 5 |
| SPF record published | 15 | 7.5 |
| SPF within lookup limits | 10 | 5 |
| SPF blocks unlisted servers | 5 | 2.5 |
| DKIM key found | 15 | 7.5 |
| DKIM key is strong | 5 | 2.5 |
| Receives email | 5 | 2.5 |
| Total | 100 |
DMARC carries the most weight because it is the record that tells receivers how to handle mail failing authentication; SPF and DKIM supply the evidence it relies on. MX counts for little, since it says nothing about who may send.
Sometimes a name server times out or answers with an error. When any lookup fails that way, the report is marked incomplete: a banner says so, the score is replaced by “Score unavailable”, and checks that could not run show a dash instead of a red cross. A timeout is not the same as a missing record, so we would rather show no number than a wrong one. Running the check again a minute later usually completes it.
What to do next
- For a lookup-count or include problem, open the SPF checker to see the full include tree.
- For policy, alignment and report addresses, the DMARC checker explains each tag it found.
- To test a provider's own selector or a key length, use the DKIM key lookup.
- To see which servers accept mail for the domain, run an MX lookup.
- New to the topic? Start with SPF vs DKIM vs DMARC, What is SPF, What is DKIM and What is DMARC, or browse every article on the learn hub.