Free tool
SPF, DKIM and DMARC checker
Enter a domain to read its live email authentication records. You'll see each record, what it means and what to fix, in plain English. Runs in your browser through public DNS.
Reading the results
SPF says which servers may send for the domain. There must be exactly one record, and it must name your mail provider. DKIM is a public key your provider publishes so receivers can check each message's signature. DMARC tells receivers what to do when SPF or DKIM fail, and where to send reports.
For a domain you use for link outreach, aim for all three to pass before the first pitch goes out, then ramp sending slowly with the warmup calculator. If something's missing, the SPF and DMARC generator builds the records, and the deliverability guide walks through the whole setup. Terms are explained in the glossary: SPF, DKIM and DMARC.
Authentication is the floor, not the finish. Read what to know before sending outreach from Google Workspace, then plan sending volume with the outreach volume planner.
Questions people ask
How does this checker work?
Your browser asks Cloudflare's public DNS-over-HTTPS resolver for the domain's TXT records, the _dmarc record and DKIM keys under common selectors. Nothing is stored or sent to BacklinkGenie. Results reflect what public DNS returns right now, so a record you just added may take a few minutes to appear.
Why can't it find my DKIM record?
DKIM records live under a selector name that only your mail provider knows, such as google._domainkey or selector1._domainkey. The tool tries the most common selectors. If yours is different, find it in your provider's admin console or in the DKIM-Signature header of an email you sent (the s= value) and enter it.
Is ~all or -all better?
Both are valid. ~all (soft fail) asks receivers to treat unlisted senders as suspicious; -all (hard fail) asks them to reject. With DMARC in place, receivers mostly follow your DMARC policy, so ~all is a safe default while you confirm every legitimate sender is listed.
What does the 10-lookup limit mean?
When a receiver evaluates SPF, it may perform at most 10 DNS lookups for include, a, mx, exists and redirect, including nested includes. Past 10, SPF returns a permanent error and fails. The tool follows includes to estimate the total.
What should a cold outreach domain show here?
One SPF record that includes your mail provider, a DKIM key for that provider, and a DMARC record with at least p=none and a rua reporting address, moving to p=quarantine once mail passes. Gmail and Yahoo expect all three from anyone sending in volume.
Related
SPF and DMARC record generator
Fix what this checker finds: build a correct SPF and DMARC record to paste into DNS.
Email deliverability for link outreach
The full setup for an outreach domain: authentication, warmup and daily limits.
Mailbox warmup calculator
See how many days a new outreach mailbox needs to reach full volume, and how many pitches a month you can send across several mailboxes.
MX record lookup
See a domain's MX records, which mail provider it uses (Google Workspace, Microsoft 365, Zoho and others) and whether it can receive email at all.
See which posts you could be in.
Paste your URL. The agent finds posts in your niche where your product fits and the editor to contact for each. Free, no card.
