Free WordPress email tools: SPF, DKIM, DMARC, and more.

Try the tools

nanoPost

The WordPress Email Authority

WordPress sends email from your domain, but receivers check your DNS records to decide whether to trust it. A missing SPF record gets you in spam. No DKIM means Gmail’s bulk sender rules can block you. Gmail requires bulk senders sending more than 5,000 messages per day to Gmail accounts to publish DMARC; Yahoo also requires DMARC for bulk senders.

This checker queries your records live using DNS-over-HTTPS — no installation, nothing sent to a server.

DNS Auth Checker

Enter your sending domain to check SPF, DKIM, DMARC, MX, MTA-STS, and TLS-RPT — and see how you score against Gmail, Yahoo, and Microsoft 365 bulk-sender requirements.

The checker reads the domain’s own SPF, DMARC, MX, MTA-STS and TLS-RPT records, and probes DKIM at every selector in nanoPost’s provider dataset plus common host and mailbox selectors. Providers that put SPF on a bounce subdomain (SendGrid, Postmark, Amazon SES custom MAIL FROM, ZeptoMail and others) need that host entered above; providers that generate a per-domain selector (Amazon SES Easy DKIM, for one) need the selector entered.

What each record does

SPF (Sender Policy Framework) lists the mail servers authorised to send on behalf of your domain. A service that sends with your domain as the envelope sender, such as Google Workspace or Microsoft 365, needs its SPF include in that domain’s record. Postmark and SMTP2GO document SPF on provider-managed return paths. SendGrid’s default automated-security setup manages SPF through an em CNAME. Amazon SES uses amazonses.com by default; a custom MAIL FROM domain needs the MX and SPF TXT records in AWS’s instructions. A missing or incomplete SPF record is the most common cause of WordPress email landing in spam.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outbound message. The receiving server checks the signature against a public key in your DNS. DKIM survives email forwarding better than SPF — it’s the record Gmail checks when deciding whether to show the padlock icon.

DMARC (Domain-based Message Authentication) ties SPF and DKIM together and tells receivers what to do with mail that fails. A policy of p=none means monitoring only. p=quarantine puts failures in spam. p=reject blocks them outright. Gmail and Yahoo require bulk senders to publish a DMARC record, and p=none meets that requirement.

MX records point incoming mail to the right server. The checker reads them as a sanity check — misconfigured MX records can cause bounce loops and explain why reply-to addresses never receive responses.

Compliance requirements

Corrections
  • 2026-11-12: an earlier version said Gmail and Yahoo require bulk senders to publish at least p=quarantine, and the scorecard failed p=none on that basis. Both accept p=none.
  • 2026-11-12: an earlier version said using SendGrid or Postmark means adding their include to the domain’s SPF record. Postmark’s default Return-Path and SendGrid’s default automated-security setup manage SPF without a root-domain include.