Will your email reach the inbox?

If your domain has no SPF or DMARC, receivers cannot tell your mail from a forgery, and order confirmations and newsletters land in spam. This reads the DNS records and reports what is missing.

Reads public DNS records for the domain. Nothing is stored.

How this check works

Shipwork looks up the SPF record at the domain root and the DMARC record at _dmarc, reports how strict each is, and notes whether the domain has MX records. DKIM needs a selector, so it is reported as not checkable from the domain alone.

What the SPF and DMARC check reads

The check resolves two DNS records for your apex domain: the TXT records at the domain itself, which carry SPF, and the TXT records at _dmarc. It also checks whether the domain has MX records. Because SPF, DMARC and MX live at the apex, it checks the registrable domain rather than the subdomain you submitted.

It then judges what it found using shared rules. SPF is reported as missing, duplicated, ending in -all or ~all, or ending in ?all which asserts nothing. DMARC is reported as missing, without a policy, set to p=none, or enforcing quarantine or reject. It does not send mail and cannot check DKIM without a selector.

How to read the email result

The clearest result is a single SPF record that ends in -all or ~all, plus a DMARC record with an enforcing policy. That is the set receivers use to tell your real mail from a forgery. A missing SPF or DMARC is a warning, not an error: you can still send mail, but more of it may be filtered.

Two SPF records is an error, because the standard allows only one and receivers may ignore both. A DMARC policy of p=none only monitors; it is a useful first step, not a resting place. The check cannot see whether your specific mail is delivered, and it cannot verify DKIM, which needs the selector your mail provider issues.

Common causes and why they matter

Email authentication is often set up once and then forgotten. A new sender or mailing tool needs its records added to SPF. A domain migration or a move to a new mail host can leave the old records or an incomplete set. Duplicate SPF records appear when a second record is added instead of editing the first.

Without SPF and DMARC, receivers cannot tell your order confirmations and newsletters from a spoofed message, so more of your mail lands in spam or is rejected. A weak policy lets spoofing continue. The impact is on deliverability and brand trust rather than on a page's search ranking. A domain that never sends mail can still publish records to prevent others spoofing its name.

How to fix SPF and DMARC

Publish one SPF record that lists every sender, and end it with -all once you are confident, or ~all while you test. Publish a DMARC record at _dmarc with a policy, starting at p=none to collect reports and moving to quarantine or reject as it looks clean. Edit the existing record rather than adding a second.

On any platform, these are DNS records, so change them where your DNS is hosted. Keep MX records if the domain receives mail. After changing them, allow for DNS caching and rerun the check. Because DKIM needs a selector, configure it with your mail provider and confirm it there, not in this check.

When to use related email and DNS checks

Use DNS check to see every record the resolver returns, and mail trust for MTA-STS, BIMI and TLS reporting. Use domain and email safety for registration expiry alongside email records.

For how trust signals affect a store, see trust signals Google expects. Recheck after adding a new sender, changing your mail host or moving your DNS.

Questions

What does SPF do?

It lists the servers allowed to send mail for your domain. Without it, a receiver cannot tell your mail from a spoof.

What does DMARC do?

It tells receivers what to do when SPF or DKIM fails (none, quarantine or reject) and where to send reports. p=none only monitors.

Can this check DKIM?

No. DKIM needs a selector, which is not public. It can only be checked with the selector your mail provider gives you.

How do I check SPF and DMARC for my domain?

The check reads the TXT records at your domain root for SPF and at _dmarc for DMARC, using the registrable domain rather than a subdomain. It reports whether each is present, how strict the SPF ending is, the DMARC policy, and whether the domain has MX records.

Is a p=none DMARC policy good enough?

It is a useful first step and a poor resting place. p=none collects reports and blocks nothing, so spoofed mail still gets through. Once the reports show that all your legitimate senders pass, move to quarantine and then reject to actually protect the domain.

Why is having two SPF records a problem?

The SPF standard allows only one record per domain. When two are published, receivers may treat the result as invalid and ignore both, so authentication fails. Keep a single record and edit it to include every sender, rather than adding a second.

Can this check verify DKIM?

No. DKIM is published under a selector that is not known from the domain alone, so it cannot be resolved without the selector your mail provider gives you. Configure and verify DKIM with that provider; this check states plainly that it cannot test it.

Do SPF and DMARC affect SEO?

Not directly. They affect whether your order and marketing email reaches the inbox, which matters for customers and revenue. Broken email authentication does not change how a page ranks, but it can hurt the business the site runs.

Keep reading

What this reads

Reads public pages from outside your network, the way a crawler does.
No signup, and nothing is stored on the free checks.
One of 83 checks across discovery, content, markup, trust and catalogue data.

83checks

0signups needed

0stored on free checks

Cool, just ran an audit and got some insights! Let’s see if I can fix them :)

Tenta Dev, @DevTenta

Whoah! this site is crazy, nothing to roast at all

Ainreek, @AinreekAI

cool as heck, tried it on my blog and the insights it gave are helpful and not bluff.

Refaat 🍉 (Mouse), @1Mouse__