---
title: "Email deliverability checker"
description: "Check any domain’s SPF, DKIM, DMARC, BIMI and MX records against live DNS. See the records as published, what each one actually says, and what is missing."
url: "https://openemail.uk/tools/deliverability"
---

Tools

# Is your domain set up to be trusted?

SPF, DKIM, DMARC, BIMI and MX, read from live DNS. You get the records as published and what each one actually says, not a score and a sales call.

## What each record does

Nothing is stored. Each check is a set of public DNS queries made when you press the button, and the answers are the same ones any receiving mail server would get.

## Questions this raises

What is a good DMARC policy? p=reject is the destination: it tells receivers to refuse mail that fails authentication. p=quarantine is the sensible step before it. p=none is monitoring only. It explicitly asks receivers to change nothing, so forgeries still land in inboxes. Start at none with a rua address collecting reports, read them for a few weeks, then move up. How many DNS lookups can an SPF record have? Ten, and that includes every lookup made inside the records you include. Past ten, SPF returns a permanent error and receivers treat your mail as unauthenticated, while the record on screen still looks perfectly correct. This is the most common way a working SPF record quietly stops working, which is why the checker follows your includes rather than counting the first line. Why could you not find my DKIM record? DKIM keys are addressed by a selector, and a domain never publishes a list of the ones it uses. The checker tries the selectors your mail provider is known to use plus a common set. Finding one proves DKIM is set up; finding none proves nothing. If your provider gave you a selector, look up that name followed by .\_domainkey and your domain directly. What happens if I have two SPF records? Both are thrown away. RFC 7208 makes more than one SPF record a permanent error, so instead of two sets of authorised servers you get none. Merge them into a single record: the includes from both, one v=spf1 at the front, one all mechanism at the end. Do I need BIMI? No. BIMI puts your logo beside your mail in supporting clients, which is worth having and changes nothing about whether mail is delivered. It also does nothing at all until DMARC is enforcing, and most large receivers want a Verified Mark Certificate as well, so it is the last thing to do, never the first.

[How OpenEmail checks senders](https://openemail.uk/features.md#safety)[DMARC on your own domains](https://openemail.uk/features.md#dmarc)[All tools](https://openemail.uk/tools.md)