SPF
The guest list
Sender Policy Framework, or SPF, names the mail services allowed to send email as your business. A receiving server checks the list before it lets a message in.
Free tool for business owners
Business email health check
Invoices landing in spam? Customers saying they never got your email? Type your domain and find out, in plain English, whether your business email is set up to be trusted.
Free, no sign-up, and it only reads public records. Takes a few seconds.
Checked
- Email host
- DNS host
- Where the fixes get made
Just keep in mind this is a snapshot of public records, not a guarantee of delivery. It cannot see your mailbox, your messages, or anyone's spam folder.
In plain English
What the check looks at
Email was built on the honor system. Anyone can put your address on a message, the same way anyone can write your return address on an envelope. Three public records fix that, and this tool reads all three.
DKIM
The seal on the envelope
DomainKeys Identified Mail, or DKIM, stamps every message with a signature only your mail service can make. It proves the message is yours and was not changed on the way.
DMARC
What happens to the fakes
Domain-based Message Authentication, Reporting, and Conformance, or DMARC, tells receiving servers what to do with a message that fails the first two: deliver it, send it to spam, or refuse it.
The check also names the company that hosts your email and the company that hosts your DNS, which is where each fix gets made. Half the battle is knowing which one to log in to.
Questions, answered
Business email questions
Why are my business emails going to spam?
One of the most common causes is missing or broken email authentication: SPF, DKIM, or DMARC. Without them, a receiving mail server cannot tell your real mail from a forgery, so it plays it safe and files you under spam. This check tells you in a few seconds whether that is your problem. If all three pass, the cause is usually the wording of the message or the reputation of the service sending it.
Do Gmail, Yahoo, and Outlook require SPF, DKIM, and DMARC?
Yes. Since February 2024, Gmail requires every sender to have SPF or DKIM, and anyone sending around 5,000 messages a day to Gmail addresses to have all three. Yahoo set the same kind of rule at the same time, and Microsoft followed in May 2025 for Outlook.com, Hotmail, and Live addresses. A small office will not hit the bulk numbers, but the direction is clear: mail that cannot prove where it came from gets less benefit of the doubt.
Is this check safe, and what can it see?
It reads public DNS records, the same ones every mail server reads each time you send a message. It cannot see your mailbox, your messages, or your passwords. The lookup runs in your browser through the public DNS services run by Google and Cloudflare. The domain you type is the only thing sent, and IT Wes does not store it.
What does "Could not confirm" mean for DKIM?
DKIM keys are filed under a name your mail service chooses, and there is no public list of those names. The check tries the most common ones. If none match, DKIM is either turned off or filed under a name the check does not know. To find out which, send an email to a Gmail address, open it there, choose Show original, and read the DKIM line. PASS next to your own domain means it is on.
Can I fix these myself?
Often, yes. Each fix is a DNS record, added at the company that hosts your DNS, and the results name that company and show a starting value. The part that trips people up is SPF. Every service that sends mail as you has to be on the list, including the website contact form and the invoicing tool everyone forgot about. Leave one off and its mail starts failing.
Can IT Wes fix it for me?
Yes. These are DNS and mail settings, so the work is done by remote session for businesses in Tucson and anywhere in the United States. Business remote support is $90 per hour. Send the report from your results, or get in touch, and we will take it from there.