Reads a domain's SPF, DKIM and DMARC records from DNS, explains what each one says and shows what to fix so your emails are trusted by mailbox providers. For founders and marketers who send email from their own domain.
How to use it
Enter the domain you send email from. An email address or a web page works too; only the domain is used.
- Type the domain, for example example.com. Add your DKIM selector if your email provider gave you one.
- Press Run check and read the three records the tool found.
- Go through the findings, starting with the critical ones, and follow the fix of each. The tool suggests a record where it can.
- Change the record at your DNS provider, wait for it to update, then run the check again.
How Reavlo tests this
This tool runs on our server, because a browser cannot query DNS. It sends DNS questions only, never a web request. Nothing about the request is stored or logged: not the domain, not the records.
SPF. The tool reads the domain's TXT records, finds the one that starts with v=spf1 and reads its terms as RFC 7208 defines them. It then follows every include: and redirect= and counts the terms that cost a DNS lookup (include, a, mx, ptr, exists and redirect). RFC 7208 allows 10; past that, receivers treat the record as an error. Counting stops once the limit is passed, and exp= and macros are not expanded.
DMARC. The tool reads the TXT record at _dmarc. plus the domain and checks its tags against RFC 7489: the policy p, the share of mail pct, and the report addresses rua and ruf.
DKIM. A DKIM key lives under a selector that only the sender knows, so DNS cannot list them. When you give selectors, the tool looks up only those. When you do not, it tries ten common ones: default, google, selector1, selector2, k1, s1, s2, mail, dkim and smtp. A key under none of them does not prove there is no DKIM, only that it is not under these names. For RSA keys the tool measures the key length from the published public key; 1024 bits is the lowest it accepts, and 2048 is recommended (RFC 8301, RFC 6376).
Mail servers. The domain's MX records are listed as context.
Limits. The tool checks that the records are published and well formed. It cannot tell whether your email provider really signs with a key, or whether a message passes at a given receiver. DNS answers can be cached for hours, so a record you just changed may not show yet. A domain that does not exist shows as having no records.
Questions
Is the domain I enter stored?
No. The domain goes to our server only to ask DNS for its records, and neither it nor the answers are stored or written to a log. Analytics records only that the tool ran, never the domain.
What is a DKIM selector and where do I find it?
The selector is the first part of the name where your DKIM key is published, such as selector1 in selector1._domainkey.example.com. Your email provider shows it in its domain-authentication settings, and in the DKIM-Signature header of any email it sent, as s=.
Why does the tool say no DKIM key was found when my emails are signed?
Without a selector, the tool tries only ten common names. If your provider uses another one, enter it in the selector field and run the check again.
Which DMARC policy should I use?
Start with p=none and a rua address to receive reports, fix the senders that fail, then move to p=quarantine and p=reject. Going straight to reject can block your own legitimate email.
Why is the limit of 10 DNS lookups a problem?
Every include in an SPF record can include more, and each costs a lookup. Together they must stay within 10, or receivers treat the whole record as an error and SPF fails.