Free email authentication checker
Is your email going to spam? Find out why in 10 seconds.
Free SPF, DKIM and DMARC checker. Enter your domain and get a plain-English pass/warn/fail for each record, plus the exact fix. No sign-up, nothing to install.
Runs in your browser. We only ask public DNS (Cloudflare 1.1.1.1, falling back to Google) for your domain's public records. Nothing is stored. What are the bulk-sender rules?
Sender rules
The sender rules now in force in 2026
Gmail and Yahoo have enforced these since February 2024; Outlook.com since May 2025. Here is what each one asks for, in plain English.
Gmail & Yahoo (since Feb 2024)
- Everyone who emails personal Gmail or Yahoo addresses needs SPF or DKIM, valid forward and reverse DNS, and a spam rate under 0.3%. Gmail also requires TLS (Yahoo's list doesn't).
- Bulk senders (about 5,000+ messages a day to Gmail addresses, counted per primary domain; Yahoo publishes no number) need SPF and DKIM and a DMARC record (at least
p=none) that passes, with your visible From domain aligned to SPF or DKIM. - DKIM keys must be at least 1024-bit (Gmail and Yahoo); 2048-bit is recommended.
- Bulk senders' marketing and subscribed mail needs one-click unsubscribe (
List-Unsubscribe+List-Unsubscribe-Postheaders, RFC 8058) and a visible unsubscribe link, honoured within 2 days. Transactional mail is exempt. Gmail does not acceptmailtoas one-click; Yahoo does accept it, though it prefers the HTTPS Post method. - Spam rate, Gmail: keep it under 0.10% and never reach 0.30%. Yahoo: keep it below 0.3%.
- Enforcement has tightened: since November 2025 Gmail has been ramping up enforcement, so non-compliant mail can now get temporary and permanent rejections, not just spam-foldering.
Outlook.com / Hotmail / Live (since May 5, 2025)
- Domains sending 5,000+ messages a day to Microsoft consumer mailboxes must pass SPF and DKIM and publish DMARC (minimum
p=none) that passes through an aligned SPF or DKIM. - Non-compliant mail is rejected (
550 5.7.515). Microsoft's docs also describe a Junk-first approach, so plan for either outcome. - This applies to consumer Outlook.com, Hotmail, Live and MSN addresses, not to work or school Microsoft 365 mailboxes.
"But I only send a few hundred emails…"
The formal bulk thresholds are high, but in practice small senders without SPF/DKIM/DMARC get filtered more, and a missing DMARC record lets anyone spoof your domain. The "everyone" rules (SPF or DKIM) already apply to you. These three records are cheap insurance and the baseline every mailbox provider expects. Google also says aligning to both SPF and DKIM will likely become a requirement eventually.
Last verified Oct 3, 2026. Sources: Google's Email sender guidelines and FAQ; Yahoo Sender Hub best practices and FAQ; Microsoft's 550 5.7.515 page, the "Strengthening Email Ecosystem" announcement and postmaster.outlook.com. Thresholds and enforcement details change; check the provider pages for current wording.
Done for you
Email authentication fixed for you, at a fixed price
Your invoices, order confirmations and newsletters are landing in spam, or bouncing. We set up SPF, DKIM and DMARC correctly on your domain, then prove it with real test emails.
Who this is for
- Small businesses and consultants on Google Workspace, Microsoft 365, Zoho or similar whose mail to clients lands in junk.
- Creators and newsletter writers sending through Mailchimp, Substack-on-custom-domain, ConvertKit, Beehiiv and the like.
- Online stores (Shopify, WooCommerce, etc.) whose order and receipt emails don't arrive.
- Anyone who got the "your domain doesn't meet Gmail/Yahoo/Outlook requirements" notice and doesn't want to learn DNS.
Not a fit: sending huge lists or cold outreach with a damaged sender reputation (authentication alone won't fix that), or spam-complaint problems caused by the content itself.
How it works
Four steps. Proven with a real email.
Tell us your domain and who sends your email
Mailbox provider, plus tools like newsletter, store, CRM and invoicing. Takes about 5 minutes.Pick how the DNS changes get made
Option A, we do it (Fix plans): give us temporary or delegated access to your DNS (see the FAQ for how to do this safely). Option B, guide mode (all plans; the only option on Starter): we send you the exact records and copy-paste steps, you add them yourself, and we check each one. No access given.We configure SPF, DKIM and DMARC
One merged SPF record (under the 10-lookup limit), DKIM for your mailbox provider and your sending services (1 on Starter, up to 3 on Fix), and DMARC in monitor mode with reports going to you.We verify
Starter: we run a verification check on the records you add. Fix plans: we send test messages from your actual senders to Gmail and Outlook.com test inboxes and check the headers show SPF, DKIM and DMARC pass with the right alignment. On the Fix plans you get a short written report plus a plan for moving DMARC to enforcement safely.
Pricing
Three fixed prices, from $129. Refund if the Fix tests fail. PROPOSED · not final
Starter PROPOSED
- For one sending service (plus your mailbox provider)
- Guide mode: you add the records yourself, we send the exact copy-paste records (host, type, value)
- Verification check of the records you add
- SPF, DKIM and DMARC in monitor mode (
p=none). No DMARC enforcement
Fix PROPOSED
- DNS audit of your current SPF, DKIM, DMARC and MX
- Single merged SPF record under the lookup limit
- DKIM for your mailbox provider + up to 3 sending services
- DMARC in monitor mode with reporting
- Verification with real test emails to Gmail and Outlook.com
- Written report + DMARC enforcement plan
- Refund if the verification tests fail (see guarantee below)
Fix + Enforce PROPOSED
- Everything in Fix
- 30 days of DMARC report monitoring
- Find and authenticate legitimate senders you forgot
- Staged move from
p=nonetoquarantinetorejectwhen reports are clean
Only worth it if you want protection against people spoofing your domain. Enforcement is not needed to meet the bulk-sender minimum.
Each extra sending service beyond 3: +$49. Each extra domain: $149. "Sending services" means the tools that send as your domain (newsletter, store, CRM, invoicing), not counting your mailbox provider. Many people fix it themselves in under an hour: the free checker tells you exactly what to change. PROPOSED · not final TODO(Sam): confirm the three tiers ($129 / $199 / $349), +$49 per extra sending service and $149 per extra domain; decide whether Starter carries the refund guarantee.
The guarantee, stated honestly
Applies to the Fix and Fix + Enforce plans. Starter includes a verification check of the records you add, but no refund guarantee while it is guided and you make the DNS changes.
After we finish, we send test emails from your real senders to Gmail and Outlook.com test inboxes. If those test messages don't show SPF, DKIM and DMARC passing (aligned to your From domain) for the senders in scope, we keep working on it, and if we still can't get them to pass, you get a full refund.
What we do not promise: inbox placement. Whether a given message reaches the inbox also depends on your sending reputation, list quality, content, and blocklists, which authentication cannot fix. We'll tell you if we see those problems.
Out of scope: senders that can't sign with your domain on their plan, DNS hosts that don't let you or us add the needed records, and domains with active blocklisting or abuse problems. We'll say so up front, before you pay where we can, and refund if it only becomes clear after. TODO(Sam): have this wording reviewed and decide the exact refund window/terms before going live.
FAQs
The questions every owner asks
Do I have to give you access to my DNS? Is that safe?
No, you don't have to. Guide mode is a first-class option: we tell you exactly which records to add (host, type, value), you paste them into your DNS provider yourself, and we verify each one from the outside using public DNS and test emails. You never share a password.
If you'd rather we do it, the safest ways are: add us as a limited user/delegate in your DNS provider (Cloudflare, GoDaddy, Namecheap, Google Domains-successors and others support this) and remove us afterwards, or screen-share while you click. We never ask for your registrar login, we don't store credentials, and you can revoke access the moment we say we're done. We never need access to your mailbox contents.
Could this break my existing email?
That's the risk we design around. We start DMARC at p=none (monitor only, nothing gets blocked), we check every sender you use before touching SPF, and we keep a copy of your original records so changes can be rolled back. We never switch to quarantine or reject without evidence from the reports (that is the Fix + Enforce plan).
What exactly is "tests pass"?
We send test emails from each in-scope sender to Gmail and Outlook.com inboxes and read the Authentication-Results headers. The test passes when SPF, DKIM and DMARC all show pass, aligned to your From domain. We include the headers in the report so you can see for yourself.
Will this guarantee my emails reach the inbox?
No, and be wary of anyone who says it will. Correct authentication removes a major reason for spam filtering and is required by Gmail, Yahoo and Outlook.com for bulk senders. Reputation, content and list quality still matter.
I already have SPF/DKIM/DMARC. Can't I just use a free tool?
Yes, if the checker above shows green, you probably don't need us. Our value is for when it's red or you can't tell what to change: we make the change, handle the awkward cases (multiple senders, SPF lookup limits, third-party tools) and prove it works with a real email.
What do you need from me?
Your domain, the mailbox provider and any tools that send as you, and either DNS access (delegated/temporary) or willingness to paste records in guide mode. Plus an address we can send test emails from, or a test inbox you can forward headers from.
What about additional domains or unusual setups?
Each plan covers one domain. Each extra domain is $149, and each sending service beyond 3 is +$49. On-premise mail servers or very complex setups are quoted separately before any work starts.
Who is behind this?
Run by an engineer who sets up and verifies mail authentication. TODO(Sam): add a real number or name here later (e.g. a verifiable count of setups, or your first name). Do not add figures that are not true.
Contact
Ready to fix it? Plans from $129.
Nothing is submitted from this page. The button below opens your own email app with a pre-filled request to sales@wrenchline.ai, so no form backend is involved.
Prices are PROPOSED. Extra sending service beyond 3: +$49. Extra domain: $149.