Menu

How email sender checks work

Email delivery depends on a few checks that help receiving systems confirm who sent a message. Learn what those checks mean, then explore the public settings for any domain

Why do these checks matter?

They help protect against forged sender addresses and help legitimate messages reach the inbox. If you arrived here from an email banner, a check did not fully pass for that message. That is a reason to investigate, but it does not automatically mean the message is malicious.

The three checks behind email delivery

SPF

SPF is a guest list. It tells receiving email systems which services are allowed to send messages for a domain.

DKIM

DKIM is a tamper check. It adds a digital signature so receiving systems can tell that a message came through an approved service and was not changed.

DMARC

DMARC is the instruction card. It tells receiving systems what to do when a message fails the SPF or DKIM checks.

Check a domain

Enter the domain shown after the @ in an email address. The checker looks at its public email delivery and security settings.

For example, use contoso.com for someone@contoso.com. The check does not send email.

Domain check results

Good Needs attention Not found

SPF

Waiting for a domain

SPF tells receiving mail systems which services are allowed to send email for your domain.

DKIM

Waiting for a domain

DKIM adds a digital signature to your messages so receiving systems can check they were not changed.

DMARC

Waiting for a domain

DMARC tells receiving systems what to do when a message fails these checks and helps stop impersonation.

Need help improving your email delivery?

We can help you understand the results, review your email setup and put the right records in place.

Book a 15-minute video call
Checks are informational and do not send email. DNS changes can take time to become visible. DKIM is checked against common selectors used by popular email services, but a provider-specific selector may not be found.