Free Email Deliverability Test: Check SPF, DKIM and DMARC, Then Run the Klaviyo Checklist

Enter your sending domain for a live check of SPF (with lookup count), DMARC, DKIM on Klaviyo's and other common selectors, BIMI and MX records, each explained in plain English. Then tick through 14 account checks across authentication, sending domain, list hygiene and engagement to score your Klaviyo setup. How the test works. Rather have a person look? See our email deliverability service.

/ Part 1

Check your domain

Use the domain in your From address (e.g. yourbrand.com). Lookups run in your browser against public DNS; nothing is sent to us.

How the deliverability test works

Part 1 runs in your browser. It sends DNS-over-HTTPS queries for your domain to Cloudflare's public resolver, with Google Public DNS as the fallback, and reads five kinds of public record. Each result gets one of four labels, and the rules behind them are fixed:

SPF fails when there is no record, more than one record, a record that ends in +all, or more than 10 DNS lookups once nested includes are counted. It warns at 9 or 10 lookups, when an include doesn't resolve, or when the record never tells receivers to distrust unlisted servers (no ~all or -all).
DMARC fails when there is no record, more than one, or no valid policy. It warns at p=none, when the policy covers less than 100% of mail, or when no rua address receives reports. It passes at p=quarantine or p=reject with reports switched on.
DKIM passes when a public key is found on any selector checked, fails when the keys found are empty (revoked), and warns when none is found, because selectors can't be listed and yours may simply be one we didn't try.
BIMI is labelled optional. It warns when a record exists but is incomplete: DMARC not enforced, no logo, or no mark certificate.
MX warns when the domain has no mail servers, so replies and bounces have nowhere to go.

Part 2 is a self-assessment. The score is the share of the 14 checks you tick: under 40% reads as at risk, under 65% as underperforming, under 85% as solid, and the rest as excellent. It weights every check equally, so treat it as a to-do list, not a measurement.

The rules your records are measured against

Since 1 February 2024, Google has required every sender to Gmail to use SPF or DKIM. Senders of more than 5,000 messages a day must have SPF, DKIM and DMARC (a p=none policy is enough), align the From domain with SPF or DKIM, support one-click unsubscribe, and keep the spam rate reported in Postmaster Tools below 0.3%, ideally below 0.1% (Google sender guidelines). Microsoft has applied similar rules to domains sending more than 5,000 emails a day to Outlook.com, Hotmail.com and Live.com since 5 May 2025: SPF, DKIM, and DMARC at p=none or stronger (Microsoft). Both checked October 2026.

That is why the test treats p=none as a warning rather than a pass: it meets the minimum, but it doesn't stop anyone sending mail in your name, and it doesn't qualify you for BIMI.

What a DNS test can't tell you

Authentication is the entry ticket. Where mail lands after that depends on things no DNS lookup can see: your sender reputation with each mailbox provider, your spam complaint rate, how many people you mail who never open, and how suddenly your volume changes. To see those, check Google Postmaster Tools for your spam rate at Gmail, watch bounce and unsubscribe rates per send in Klaviyo, and compare engagement between your engaged segments and your full list. If authentication passes here and mail still lands in spam, look there next.

What this checker looks up

SPF: the v=spf1 TXT record on your domain, its all policy, and the total DNS lookups including nested includes (the limit is 10).
DMARC: the TXT record at _dmarc.yourdomain.com (falling back to your organisational domain for subdomains), with the policy, percentage and reporting explained.
DKIM: public keys on common selectors: Klaviyo (kl, kl2, km1, km2), Google Workspace (google), Microsoft 365 (selector1, selector2), Mailchimp/Mandrill (k1, k2, mandrill), SendGrid (s1, s2) and others, plus any selector you add.
BIMI: the record at default._bimi.yourdomain.com, and whether it references a logo and a mark certificate.
MX: where your domain receives email, so replies and bounces have somewhere to go.

DNS can't tell you everything. DKIM selectors can't be listed, so "not found on common selectors" isn't proof DKIM is missing; check the s= value in a sent email's DKIM-Signature header. For the full background, read our guides to DMARC, SPF and DKIM, Gmail and Yahoo's sender requirements and BIMI, or see our ecommerce deliverability guide.

Frequently asked questions

How do I check my DKIM record?

DKIM keys live at a selector, for example kl._domainkey.yourbrand.com. Enter your domain above and the checker looks up common selectors, including Klaviyo's (kl, kl2, km1, km2), Google Workspace and Microsoft 365. If yours isn't found, open a sent email's headers, find the DKIM-Signature line, and enter the value after s= as a custom selector.

What does a DMARC check tell me?

It shows whether your domain publishes a DMARC record at _dmarc.yourdomain.com, what policy it sets (none, quarantine or reject), whether it applies to all mail, and whether reports are being sent anywhere. Gmail and Yahoo require bulk senders to have at least p=none; p=quarantine or p=reject is what actually stops spoofing.

What is the SPF 10-lookup limit?

SPF allows at most 10 DNS lookups while evaluating a record. Every include, a, mx, ptr, exists and redirect counts, including those nested inside includes. Go over 10 and SPF returns a permanent error, which fails authentication. The checker counts nested lookups for you and flags records at or near the limit.

Is this a full email deliverability test?

It tests the part of deliverability you can see from DNS: whether your domain authenticates properly. It cannot see inbox placement, your sender reputation, your spam complaint rate or how engaged your list is, which decide where mail lands once it authenticates. The checklist below covers those account habits, and Google Postmaster Tools shows your spam rate at Gmail.

Is this checker private?

The lookups run in your browser. Your browser queries public DNS-over-HTTPS resolvers (Cloudflare, with Google Public DNS as a fallback) for public DNS records. Nothing is sent to Email Optimize and we don't store the domains you check. DNS records are public information that any mail server can see.

Records look right but emails still land in spam? Authentication is only the entry ticket; engagement and list quality decide placement. Our email deliverability service fixes both, or start with a free Klaviyo audit.