Email setup checker: is your domain ready for cold email?

Home › Free tools › Email setup checker

Type a domain you send email from. This page reads its MX, SPF, DMARC and DKIM records live from public DNS, grades them, and says in plain words what to fix before you send cold email from it.

Nothing is stored or sent to our servers. Your browser asks Cloudflare’s public DNS resolver directly, the same question any mail server asks. Open your network panel while it runs: every request goes to cloudflare-dns.com, or to dns.google if Cloudflare does not answer.

Using the checker

Type a domain, such as acme.com, and press Check domain. A web address or an email address works too; the checker keeps only the domain. In a second or two it shows a grade from A to F for MX, SPF and DMARC, then one card each for MX, SPF, DMARC and DKIM. Each card shows the record as published, what it means and what to change, with any record to publish ready to copy. The SPF card also lists each include and the DNS lookups it costs.

Short answer: To check whether a domain is ready for cold email, read four DNS records: MX, SPF, DMARC and DKIM. Type the domain above. This page looks them up live, grades MX, SPF and DMARC, and says what to change. Google and Yahoo want SPF or DKIM from every sender, and DMARC as well from bulk senders.

How the check works

Your browser asks Cloudflare's public DNS resolver (Google's as a fallback) for four things:

The MX records, which say where replies go.
The SPF record: that there is exactly one, how it ends (-all, ~all, ?all or +all), and the DNS lookups its includes cost against the limit of 10 in RFC 7208.
The record at _dmarc. plus your domain: the policy (p=), subdomain policy (sp=), coverage (pct=) and report address (rua=).
DKIM keys at ten common selectors: google, selector1, selector2, default, k1, s1, s2, resend, mail and dkim.

How the grade works

MX, SPF and DMARC each pass, warn or fail, and the worst finding caps the grade. A clean sheet is an A. One warning is a B, two or more a C. One fail is a D, two or more an F. DKIM is shown but not graded, because a key I cannot find may still exist. The free GTM teardown includes this check, graded the same way, beside the ICP and cold email it writes for your company.

I mark p=none as a warning even though Google and Yahoo accept it: it asks receivers to do nothing with mail that fails.

What Google and Yahoo ask for

Checked on 21 October 2026:

Google's sender guidelines: every sender needs SPF or DKIM. Above 5,000 messages a day to Gmail accounts, you need SPF, DKIM and DMARC, and the DMARC policy "can be set to none". DKIM keys must be 1024 bits or longer for personal Gmail accounts.
Yahoo's sender requirements: every sender needs SPF or DKIM. Bulk senders need both, plus a DMARC policy of at least p=none that passes. Yahoo asks for DKIM keys of at least 1024 bits.

I publish all three on every sending domain, whatever the volume. The full Google, Yahoo and Microsoft table is in how many cold emails per inbox per day.

Limits

DKIM selectors are private. Your provider picks the name and DNS cannot list them, so no key found does not mean no DKIM.
The lookup count is an estimate. A receiver stops at the first match, so its count can differ.
It reads DNS only, not your sending IPs, blocklists, spam rate or copy. Good records let mail land; they do not make it land.
Check every domain you send from. For cold email, use separate domains, never the one your invoices come from.

Nothing is stored

The lookups run in your browser. The domain goes to the DNS resolver and never to our servers. Nothing is saved. Like every page here, it counts one page view, which holds the page address and the referring site and nothing you type.

Then check the list itself: the lead list checker flags contacts who have probably changed jobs.

Frequently asked questions

How do I check SPF, DKIM and DMARC for a domain?

Type it above. The page reads MX, SPF and DMARC from public DNS, tries ten common DKIM selectors, and says what to fix.

Why does it say no DKIM key was found when I have DKIM?

Your provider probably uses a selector outside the ten I try. Open an email you sent, show the original, and read s= in the DKIM-Signature line. That is your selector.

Is DMARC p=none good enough?

To start, yes. Google and Yahoo accept it for bulk senders, and with a rua address you get reports without any change to delivery. It protects nothing, though. When the reports show your real mail passing, move to p=quarantine.

What does too many SPF lookups mean?

RFC 7208 caps an SPF check at 10 DNS lookups. Past that, receivers return an error and SPF fails. Remove includes for services you no longer send through.