Check SPF, DKIM and DMARC
Enter a domain name. We read its three email authentication records, follow the SPF chain to the end, and tell you what is stopping your emails from arriving.
The three records, and what each one proves
| Record | What it says | The most common mistake |
|---|---|---|
| SPF | which servers are allowed to send for the domain | more than ten DNS lookups, after adding sending service after sending service |
| DKIM | a signature proving the email was not altered | a sending service added without publishing its key |
| DMARC | what to do with an email that fails both, and whom to report to | p=none set years ago and never tightened |
Why it became mandatory
Since February 2024, Gmail and Yahoo require SPF or DKIM, and DMARC, from any sender who sends in bulk; Microsoft followed in 2025. Without them, your emails are rejected or filed as spam, including your invoices and order confirmations.
The ten-lookup limit
Every include:, a, mx or redirect= in your SPF requires a DNS lookup, and each include often calls others. Beyond ten, the standard says SPF is in error: for all your emails, without anything visibly breaking. It is the most frequent failure, and the most invisible one. This tool follows the chain to the end and counts.
DMARC, in order
Start with p=none and a rua address to receive the reports, fix the sending services that fail, move to p=quarantine, then to p=reject. Staying on p=none means watching without ever protecting.
What this tool does not do
- It sends no email: it reads DNS. To see the real result of a send, look at the Authentication-Results header of an email received.
- It cannot prove DKIM is missing: only find it under the common selectors.
- It does not check BIMI or MTA-STS, which come after a strict DMARC setup.
Frequently asked questions
My emails land in spam even though SPF is valid. Why?
Because SPF alone is no longer enough: Gmail and Yahoo also require DKIM and DMARC, and alignment between the sender's domain and the signing domain. A sending service (newsletter, invoicing) that signs with its own domain often fails alignment.
What is the difference between ~all and -all?
~all marks emails coming from elsewhere as suspicious, -all asks for them to be rejected. ~all is the usual setting: DMARC then decides. -all is stricter, and breaks email forwarding.
Should I set DMARC to reject straight away?
No. Go through p=none with reports (rua) for a few weeks first, fix the sending services that fail, then quarantine, then reject. Moving to reject too early makes legitimate emails disappear.
The other tools
Check an SSL certificate
Certificate expiry date, issuer, and the names it actually covers.
Check security headers
HSTS, CSP, X-Frame-Options and the rest: a score out of 100, with the scale and the raw headers.
Can my page be indexed?
Noindex, robots.txt, canonical, HTTP status: what stops Google and Bing from indexing a page, engine by engine.
Your site and your domain, monitored
Expansel checks your site and its certificate at regular intervals and warns you before your domain expires: the three failures that also cut off email.