Domain email checker
Type your domain to see where its mail goes, whether your emails will be trusted and whether someone could fake your address. Everything is explained in plain English, with what to fix.
What this checker looks at
Four DNS records decide whether email to and from your domain works. You set them at the company where you bought your domain, such as GoDaddy, Namecheap or Cloudflare.
| Record | What it does | What usually goes wrong |
|---|---|---|
| MX | Tells other servers where to deliver mail for your domain. | It still points to an old provider, so mail lands somewhere you don't look. |
| SPF | Lists the services allowed to send email as your domain. | Two SPF records, or more than 10 lookups, and the check fails for every message. |
| DKIM | Signs each message so the receiver can tell it really came from you. | It was never switched on, which is common with Google Workspace. |
| DMARC | Tells receivers what to do with mail that fails SPF and DKIM, and sends you reports. | It's missing, so nothing stops someone sending mail that looks like yours. |
Since February 2024, Gmail and Yahoo require everyone who sends to them to have SPF or DKIM, and bulk senders to have DMARC as well. A small business doesn't count as a bulk sender, but missing records are still one of the main reasons replies land in a client's spam folder.
Common problems and how to fix them
Two SPF records
A domain can only have one SPF record. When a new service tells you to "add an SPF record", people often add a second one, and then both stop working. Merge them: keep one v=spf1, put every include: in it and end with a single ~all.
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
Too many SPF lookups
Each include: can pull in more includes, and SPF stops at 10 lookups. Above that, the check fails. Remove services you no longer send with. The checker counts the lookups for you.
SPF ends in +all
+all means "anyone may send as this domain". Change it to ~all.
DKIM not switched on in Google Workspace
Google Workspace doesn't sign your mail with your own domain until an admin turns it on. In the Google Admin console, go to Apps > Google Workspace > Gmail > Authenticate email, generate a key, add the TXT record at your registrar and click Start authentication.
No DMARC record
Add a TXT record named _dmarc. Start in monitoring mode, so nothing you send gets blocked while you check the reports:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
After a couple of weeks of clean reports, change p=none to p=quarantine. Fakes then go to spam instead of the inbox.
MX records at two providers
If you moved email providers and didn't delete the old MX records, some mail can still go to the old one. Keep only the records your current provider gives you.
Why this matters if you use Gmail
Many small businesses forward their domain's mail to a free Gmail account and reply with Gmail's Send mail as. Gmail removes Send mail as for non-Google addresses in January 2027. Forwarding keeps working, but replies from your business address in Gmail stop. If the checker shows your mail isn't hosted by Google Workspace, read the guide, or check in three questions whether you're affected.
Frequently asked questions
What is an MX record?
An MX record tells other mail servers where to deliver email for your domain. If it points to the wrong place, or there isn't one, mail to your address goes missing or bounces.
What happens if my domain has two SPF records?
A domain may only have one SPF record. With two, receiving servers treat SPF as broken for every message, so merge them into a single record that lists every service you send with.
Why can't the checker find my DKIM record?
DKIM records live under a name called a selector, and there's no way to list them all. The checker tries the selectors that common providers use. If yours uses another one, open an email you sent, look for s= in the DKIM-Signature header and check that selector.
What DMARC policy should a small business use?
Start with p=none and a rua address so you receive reports. Once the reports show your own mail passing for a couple of weeks, move to p=quarantine, which sends fakes to spam.
Do you store the domains I check?
No. The lookups go from your browser straight to Cloudflare's public DNS resolver. Letterdoor never sees which domain you checked.
Does Gmail's January 2027 change affect my domain?
If your domain's email isn't hosted by Google Workspace and you reply from it in Gmail with Send mail as, yes. Gmail removes Send mail as for non-Google addresses in January 2027. Forwarding into Gmail keeps working.