What this domain check reviews before outreach
The tool reads the domain’s public DNS records and checks their structure. SPF identifies authorised sending sources, DKIM checks for a public signing key, and DMARC sets the domain’s instruction for a receiving server when authentication does not align. This is an initial technical check before connecting mailboxes and sending your first outreach wave.
| Check | What it looks for | What a failure means |
|---|---|---|
| SPF | One TXT record listing authorised sending services | The sending server is missing or the record conflicts |
| DKIM | A public key published under a selector | The message signature cannot be verified |
| DMARC | A policy and, where needed, a reporting address | The domain gives no instruction for unverified mail |
The check reads published DNS data, not the settings inside your email account. A record can therefore look correct while messages are still unsigned because DKIM has not been enabled for the relevant mailbox. See the practical SPF, DKIM and DMARC setup guide for the configuration and verification sequence.
How to read an SPF result without false confidence
SPF answers one question: has the domain owner authorised this email service to send mail? A working record usually begins with v=spf1, lists permitted mechanisms and ends with a policy, often -all or ~all. Two separate SPF TXT records for one domain are an error, because a receiving server may return an indeterminate result.
A common situation is that routine correspondence is sent through one service and outreach through another, but only the first is included in SPF. The outreach message then comes from an unauthorised source and cannot support DMARC authentication. Do not add services blindly: first list every real sending source and follow its SPF guidance.
A long SPF chain with many nested include mechanisms can also fail because receiving servers limit DNS lookups during validation. The tool can flag a complex record, but simplifying it requires an inventory of the services that actually send on your behalf.
Why DKIM matters even when SPF passes
DKIM adds a cryptographic signature to an email. The recipient retrieves the public key from DNS and verifies that important parts of the message were not altered after sending. It is a separate check: SPF concerns the sending source, while DKIM concerns the signature and the domain named in it.
The selector and key matter in the result. If the selector in an email header does not match the DNS subdomain, or the key was published incorrectly, the signature will fail. After publishing a record, send a test email to an external address and inspect the technical headers for dkim=pass, not merely for the presence of a DNS record.
Before a campaign, DNS checks should sit alongside email list verification. A clean list cannot compensate for an invalid domain signature, but it does reduce avoidable delivery failures.
How DMARC connects the visible From domain to authentication
DMARC does more than check whether SPF or DKIM passed. It compares the domain in the visible From field with the domain that passed SPF or DKIM; this is called alignment. A message can show spf=pass but still fail DMARC if the authenticated domain is unrelated to the sender address.
- Start with a DMARC record in monitoring mode so you can collect information without asking receivers to reject messages.
- Check test sends from every email service you use and identify sources that are not aligned.
- Only tighten the policy after correcting the issues, if your email setup requires it.
For example, a message may show name@company.ru in the From field while the sending service signs with its own platform domain. The recipient sees your name, but the receiving server cannot connect that signature to company.ru. See the glossary entries for SPF, DKIM and DMARC.
What a DNS record check cannot tell you
A DNS check does not measure domain or IP reputation, message content, recipient complaints, list quality or actual inbox placement. It also cannot see private email-service settings, such as whether signing is enabled for a particular mailbox, which Return-Path is used or how a platform modifies a message during sending.
This tool is not a complete readiness test for a large launch. If records pass but messages do not arrive or land in spam, the domain, mailboxes, list and sending scenario need to be reviewed together. In that case, consider a cold outreach and deliverability audit.