The three layers of protection
SPF is a list of servers allowed to send email on behalf of your domain. DKIM is a digital signature that proves an email really comes from you and was not altered on the way. DMARC tells recipients what to do with emails that fail both checks: deliver them, move them to spam or reject them.
Only all three together protect you effectively. SPF and DKIM alone help little as long as DMARC is missing.
How the grade is calculated
| Check | Weight |
|---|---|
| DMARC present and strictly configured | 35% |
| SPF present, valid and with a clear rule | 30% |
| DKIM key found | 25% |
| MX record present | 10% |
We show MTA-STS as additional information; it does not count towards the grade.
Why DKIM is sometimes not found
A DKIM key can only be looked up if you know its name, the so-called selector. We try the names used by all major providers, such as Google Workspace, Microsoft 365 and Proton. If your provider uses a different one, we show a warning even though DKIM may be set up. To be sure, look at the header of an email you have sent.
Step by step: How to set up SPF, DKIM and DMARC.
Frequently asked questions: Email Security Check
How do I check SPF, DKIM and DMARC for my domain?
Enter your domain or an email address into the email security check. We query all three records, give them a grade and explain what is missing or misconfigured.
What is the difference between SPF, DKIM and DMARC?
SPF defines which servers may send email for your domain. DKIM signs every email digitally. DMARC tells recipients what to do with emails that fail both checks.
Why do my emails end up in spam?
A common reason is missing or broken SPF, DKIM and DMARC records. Since 2024, Gmail and Yahoo require them from bulk senders and also treat missing records negatively for small senders.
Which DMARC policy is the right one?
Start with p=none and watch the reports for a few weeks. Once all your genuine emails pass SPF or DKIM, switch to p=quarantine and later to p=reject.