Free Ciela tool

Email Domain Checker

Q: What is a DMARC policy and which should I use?

DMARC has three policy levels. p=none means monitor only — unauthorized emails still get delivered but you receive reports about them. p=quarantine sends unauthorized emails to the spam folder. p=reject blocks them entirely before delivery. Always start with p=none and monitor for at least two weeks before moving up. Jumping to reject too quickly can accidentally block legitimate emails if your setup isn't perfect.

Check your email domain's authentication status and deliverability score.

Checker

Check Your Domain

Why it matters

Why Check Your Domain?

Better Deliverability

Ensure your emails reach the inbox, not the spam folder.

Prevent Spoofing

Protect your domain from unauthorized email sending.

Improve Results

Higher deliverability means higher reply rates on your campaigns.

DNS records

What Are DNS Records?

DNS records are technical settings that authenticate your domain and emails. They tell email providers that you're the legitimate sender and your emails should be trusted.

SPF (Sender Policy Framework)

Specifies which servers are authorized to send emails from your domain.

DKIM (DomainKeys Identified Mail)

Digitally signs your emails to prove they weren't tampered with in transit.

DMARC (Domain-based Message Authentication)

Combines SPF and DKIM to protect your domain from unauthorized use and phishing.

How to fix

How to Fix Email Domain Authentication Issues

Once you've identified what's missing, here is how to fix each record step by step. Most issues can be resolved in under 30 minutes. The hardest part is the 24-48 hour DNS propagation wait.

Step 1. Fix SPF

Log into your DNS provider (Cloudflare, GoDaddy, Namecheap, etc.) and add a TXT record to your domain. The value authorizes your email sending provider. For Google Workspace: v=spf1 include:_spf.google.com ~all. For SendGrid: v=spf1 include:sendgrid.net ~all. You can only have one SPF record. Combine multiple senders into one record using multiple include statements.

Step 2. Enable DKIM

Go into your email service provider's settings (Gmail Admin, Mailchimp, Instantly, etc.) and find the DKIM section. Enable DKIM. This generates a public/private key pair. Copy the public key (it looks like a long string of characters) and add it as a TXT record in your DNS under a subdomain like google._domainkey.yourdomain.com. Your ESP's documentation will give you the exact subdomain name and value.

Step 3. Set Up DMARC

Add a TXT record to _dmarc.yourdomain.com with the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start with p=none (monitor-only mode) for 2 weeks to review reports. Once you see only legitimate email in the reports, change to p=quarantine (send unauthorized emails to spam), then eventually p=reject (block them entirely). Never jump straight to reject.

DNS Propagation Time

After making DNS changes, expect 24-48 hours for them to fully propagate across the internet. In some cases, especially with high TTL (Time to Live) settings, it can take up to 72 hours. You can use a tool like MXToolbox to check propagation status. Don't run your cold email campaigns until all three records show as passing.

FAQ

Frequently Asked Questions

Why is my email going to spam even though I have SPF?

SPF alone is not enough. Modern spam filters look at all three: SPF, DKIM, and DMARC working together. If DKIM is missing, your emails aren't cryptographically signed, so receiving servers have no way to verify they weren't tampered with in transit. Also check your bounce rate (keep it under 2%), spam complaint rate (under 0.1%), and whether your IP or domain appears on any blacklists. A high bounce rate or spam complaint rate can suppress your inbox placement regardless of authentication records.

What is a DMARC policy and which should I use?

DMARC has three policy levels. p=none means monitor only. Unauthorized emails still get delivered but you receive reports about them. p=quarantine sends unauthorized emails to the spam folder. p=reject blocks them entirely before delivery. Always start with p=none and monitor for at least two weeks before moving up. Jumping to reject too quickly can accidentally block legitimate emails if your setup isn't perfect.

How long does it take for DNS changes to propagate?

Typically 24-48 hours for most DNS providers and record types. However, propagation time depends on your domain's TTL (Time to Live) setting. Lower TTL values (e.g., 300 seconds = 5 minutes) propagate faster. Higher TTL values (e.g., 86400 = 24 hours) can take the full duration. You can use tools like MXToolbox or Google's DNS checker to verify when your records are live globally. During propagation, you may see inconsistent behavior as different DNS servers around the world update at different rates.

What is an MX record and why does it matter?

MX (Mail Exchange) records tell other email servers where to deliver email sent to your domain. Without correct MX records, your domain cannot receive email. For outbound cold email campaigns, your MX records need to point to your email provider (e.g., Google Workspace, Microsoft 365) so that replies land in your inbox. Missing or misconfigured MX records mean prospects who reply to your outreach will get delivery failures, causing you to miss responses and damaging your sender reputation.

The tool behind this checker

This is a free tool from Ciela.

Ciela runs AI outbound and drops a live, personalized AI demo of each prospect's own business into the outreach, so the product sells before the first call. It also gives you a proven demo playbook for 70+ niches, so you never start from a blank page.

🔔

HVAC

Missed Call Text Back

💆

Med Spa

Post-Consultation Follow-Up

🏠

Real Estate

Missed Call Text Back

⚖️

Law Firm

AI Intake Assistant