Question 1

What do SPF, DKIM and DMARC actually do?

Accepted Answer

They answer three different questions. SPF lists which servers are allowed to send mail as your domain. DKIM cryptographically signs each message so a receiver can prove it wasn't altered and really came from you. DMARC ties the two together and — this is the part most domains get wrong — tells receivers what to actually do when a message fails. Without DMARC set to quarantine or reject, the first two are just advice that receivers are free to ignore.

Question 2

My DMARC record exists but the tool says it isn't enforcing. Why?

Accepted Answer

Almost certainly because your policy is p=none. That setting means 'monitor only' — receivers report failures back to you but still deliver the mail. It's the correct place to start, but it was designed as a temporary stage while you confirm your legitimate senders pass. A domain sitting on p=none looks protected in most checkers and is still fully spoofable. Move to p=quarantine, then p=reject, once your aggregate reports look clean.

Question 3

What is the SPF 10-lookup limit and why does it matter so much?

Accepted Answer

SPF evaluation is capped at 10 DNS lookups by RFC 7208. Each include, a, mx, ptr and exists term costs one — and includes count everything inside them too, so adding one email provider can consume several. Go over the limit and receivers return a permanent error, which means SPF stops working entirely, including for mail that should have passed. It's a silent failure: nothing in your DNS looks broken. This tool resolves your include chain recursively to show the real total, not just the terms visible in your own record.

Question 4

The tool says DKIM is 'not verified' — is my DKIM broken?

Accepted Answer

Not necessarily, and we deliberately don't claim it is. DNS offers no way to list which DKIM selectors a domain publishes; you can only ask about a selector you already know the name of. So this tool probes a list of common provider selectors (google, selector1, k1 and others). If you sign with a custom selector, it will show as unverified even though DKIM is working perfectly. Check your mail provider's DKIM settings page for the selector name it uses.

Question 5

Do I need SPF and DMARC if I never send email from my domain?

Accepted Answer

Yes, and arguably more urgently. A domain that sends no mail is a free spoofing target — attackers use exactly these domains for phishing because nobody notices. Publish a record that authorises nobody (v=spf1 -all), a DMARC record set to reject, and a null MX record. It takes minutes and makes the domain unusable for impersonation.

Question 6

Is this data live, and is anything estimated?

Accepted Answer

It's live. Every result comes from a DNS record queried through Cloudflare's DNS-over-HTTPS resolver at the moment you run the scan, with a short server-side cache. Nothing here is modelled, estimated or benchmarked against other domains — the score is a straight sum of individual checks, and each one shows exactly how many points it contributed and why.

Email Deliverability Checker

Frequently Asked Questions

More Free Tools