Skip to content
Sign inGet started
Help · MoreEmail DNS checker: MX, SPF, DKIM and DMARC in one go
Start here

Email DNS checker: MX, SPF, DKIM and DMARC in one go

Type a domain to check its MX, SPF, DKIM and DMARC records at once, with what to fix for Cloudflare Email Routing and Email Sending. Free, no sign-up.

On this page · 5 sections

What it checks

MX
Where it looks: example.com
What counts as right: At least one mail server. For Email Routing, all three of route1, route2 and route3.mx.cloudflare.net, and nothing else. [3]
SPF
Where it looks: TXT at example.com
What counts as right: Exactly one v=spf1 record, with include:_spf.mx.cloudflare.net when Cloudflare receives your mail, ending in ~all or -all, and within 10 DNS lookups. [3][4]
DKIM, receiving
Where it looks: TXT at cf2024-1._domainkey.example.com
What counts as right: A public key, which Email Routing adds when you switch it on. [2][3]
DKIM, sending
Where it looks: TXT at cf-bounce._domainkey.example.com
What counts as right: A public key, if you send through Cloudflare Email Sending. [2]
DKIM, your selector
Where it looks: TXT at selector._domainkey.example.com
What counts as right: A public key. Fill in the selector your other sender uses, such as google for Google Workspace.
DMARC
Where it looks: TXT at _dmarc.example.com
What counts as right: Exactly one v=DMARC1 record with a p= policy, ideally with an rua= address for reports. [5]

Reading the results

  • OK: the record is there and looks right.
  • Fix: the record is there but something in it will cost you, such as an SPF record without Cloudflare's include.
  • Missing: the record isn't there, or is broken in a way receivers ignore, such as two SPF records.
  • Note: worth knowing, but only matters for some setups, such as the Email Sending key when you don't send through Cloudflare.

The usual problems

More than one SPF record
A receiver that finds two treats SPF as a permanent error, so it fails for every message. Merge them into one. [4]
SPF needs more than 10 lookups
Each include:, a, mx and redirect= costs a lookup, and the includes' own lookups count too. Past 10, SPF fails. [4] The checker counts only your record's own terms, so the real count can be higher: the SPF lookup counter follows every include.
No Cloudflare include
Mail Cloudflare forwards or sends for you can fail SPF. Add include:_spf.mx.cloudflare.net to the record you have. [3]
MX points to Cloudflare and somewhere else
Senders try the lowest priority number first, so part of your mail skips Email Routing.
No DMARC record
Gmail asks for one from anyone sending 5,000 or more messages a day. [6] p=none is enough to start, and the DMARC record generator writes it for you.
Two DMARC records
Receivers discard every record when there's more than one, so the domain has no DMARC policy. [5]

The records Cloudflare expects, and how to merge an SPF record you already have, are in SPF, DKIM and DMARC on Cloudflare. If mail still isn't arriving, see Cloudflare Email Routing not working.

Or let Ayoh add them

When you connect a domain, Ayoh switches on Email Routing, adds or merges the SPF record, registers the domain for Email Sending and creates a DMARC record if there isn't one, all in your own Cloudflare account. Each step shows a check or the reason it failed.

Sources

Read October 31, 2026.

PreviousSPF, DKIM and DMARC on Cloudflare: the records to addNextSPF too many DNS lookups? Count every include