Find out why emails land in spam: the checker reads the MX, SPF, DKIM and DMARC records of the domain and explains what to fix.
The DNS queries go from your browser to Cloudflare's public resolver over HTTPS. Tooly's server is not involved and nothing is stored.
About the SPF, DKIM & DMARC Checker
When emails from a domain land in spam, the cause is usually in three DNS records: SPF says which servers may send for the domain, DKIM signs each message, and DMARC tells receivers what to do when both fail. Enter a domain or an email address and the checker reads them, along with the MX records, explains each one and says what to fix.
How to use the SPF, DKIM & DMARC Checker
-
Enter the domain
Type a domain like example.com or paste a full email address; the part after @ is used. If you know your DKIM selector, add it in the second field.
-
Read the summary
The four tiles show at a glance whether SPF, DKIM, DMARC and MX are fine, worth reviewing or broken. Click one to jump to its details.
-
Fix the records in your DNS
Each finding says what to change. Edit the TXT records with your DNS provider, wait for the change to spread (minutes to a few hours) and check again.
When to use it
Emails landing in spam
A missing DMARC record, an SPF over the 10-lookup limit or a missing DKIM key are the usual reasons Gmail and Outlook distrust a domain.
Adding a new sending service
After adding a newsletter or CRM tool, check that its include fits in SPF and that its DKIM key is published under its selector.
Protecting a domain that sends no mail
Parked and website-only domains can still be spoofed. Check that they publish v=spf1 -all and a DMARC policy of reject.
Frequently asked questions
Why does it not find my DKIM key?
DKIM keys are published under a selector, and DNS has no way to list them, so the checker tries more than 30 selectors that common providers use. If yours uses another, open an email from the domain, find s= in the DKIM-Signature header and enter that value in the selector field.
What does "too many DNS lookups" mean for SPF?
Receivers stop evaluating SPF after 10 DNS lookups (each include, a, mx, ptr, exists and redirect counts, including those inside includes) and treat the record as broken. Remove services you no longer use, or replace includes with the ip4 and ip6 ranges they stand for.
Should my DMARC policy be none, quarantine or reject?
Start with p=none and a rua address to receive reports for a few weeks. When the reports show that all your real mail passes, move to quarantine and then to reject, which stops others from sending as your domain.
How long do DNS changes take to show here?
The checker asks Cloudflare's public resolver, which caches records for the time-to-live (TTL) the domain sets, often between 5 minutes and an hour. After that, a new check shows the new record.
Is the domain I check stored?
No. The DNS queries go from your browser to Cloudflare's public resolver over HTTPS; Tooly's server is not involved. Your recent domains are kept only in this browser.
Related tools
Browse all free online tools on Tooly — every one runs in your browser, with no account required.