Enter a domain (or an email address) to see which servers receive its mail, in priority order, and whether its SPF, DMARC and DKIM records will get its own mail delivered. Free, no signup.
30 free lookups a day. Answers come live from the domain's DNS, not a cache of ours.
We ran this lookup on 20 domains on 26 October 2026. All but one publish DMARC at p=quarantine or p=reject; gmail.com itself stays at p=none. SPF lookup counts range from 0 to the full 10: github.com sits exactly at the limit, so one more mail tool added with include: would break its SPF.
| Domain | MX, SPF, DMARC |
|---|---|
| google.com | MX smtp.google.com; SPF ~all, 1/10 lookups; DMARC p=reject; CAA |
| gmail.com | MX gmail-smtp-in.l.google.com; SPF redirect, 1/10 lookups; DMARC p=none; CAA |
| microsoft.com | MX microsoft-com.mail.protection.outlook.com; SPF -all, 7/10 lookups; DMARC p=reject; CAA |
| apple.com | MX mx-in.g.apple.com; SPF ~all, 2/10 lookups; DMARC p=quarantine; CAA |
| amazon.com | MX amazon-smtp.amazon.com; SPF -all, 4/10 lookups; DMARC p=quarantine |
| github.com | MX github-com.mail.protection.outlook.com; SPF ~all, 10/10 lookups; DMARC p=quarantine; CAA |
| stripe.com | MX aspmx.l.google.com; SPF ~all, 7/10 lookups; DMARC p=reject; CAA |
| shopify.com | MX aspmx.l.google.com; SPF ~all, 4/10 lookups; DMARC p=reject |
| salesforce.com | MX mxa-00177002.gslb.pphosted.com; SPF ~all, 4/10 lookups; DMARC p=reject |
| mailchimp.com | MX mx1.intuit.iphmx.com; SPF ~all, 7/10 lookups; DMARC p=reject; CAA |
| hubspot.com | MX smtp.google.com; SPF redirect, 4/10 lookups; DMARC p=reject |
| wikipedia.org | MX mx-in1001.wikimedia.org; SPF ~all, 1/10 lookups; DMARC p=reject; CAA |
| bbc.co.uk | MX cluster1.eu.messagelabs.com; SPF ~all, 4/10 lookups; DMARC p=reject; CAA |
| nytimes.com | MX aspmx.l.google.com; SPF ~all, 5/10 lookups; DMARC p=reject; CAA |
| paypal.com | MX mx1.paypalcorp.com; SPF ~all, 9/10 lookups; DMARC p=reject; CAA |
| netflix.com | MX aspmx.l.google.com; SPF -all, 7/10 lookups; DMARC p=reject; CAA |
| reddit.com | MX aspmx.l.google.com; SPF -all, 3/10 lookups; DMARC p=reject; CAA |
| zoom.us | MX mxa-00569201.gslb.pphosted.com; SPF ~all, 6/10 lookups; DMARC p=reject; CAA |
| wordpress.org | MX smtp1-dca.wordpress.org; SPF -all, 1/10 lookups; DMARC p=reject; CAA |
| example.com | null MX (no mail); SPF -all, 0/10 lookups; DMARC p=reject |
v=spf1): exactly one record; at most 10 DNS lookups counting every nested include:, a, mx, exists: and redirect= (more is a permanent error, and SPF fails for all mail); an ending of ~all or -all, not ?all or +all._dmarc.domain): one record with a p= policy. p=none only monitors; spoofed mail is still delivered. A rua= address gets you daily reports of who sends as your domain. Gmail and Yahoo require DMARC from bulk senders since 2024.selector._domainkey.domain and the selector name is only in signed mail headers, so DNS can't list them. We try 15 common ones (google for Google Workspace, selector1/selector2 for Microsoft 365, k1 for Mailchimp, s1/s2 for SendGrid...). Not found doesn't mean missing: check the s= tag in a DKIM-Signature header of a mail you sent.The same lookup runs over the Shotmint API, free with any key (500 checks a day, 0 credits): check a client list's email setup in a spreadsheet, or alert in Make, n8n or cron when someone's SPF crosses 10 lookups.
curl -s "https://shotmint.creasework.com/v1/check?type=dns&url=github.com" \
-H "X-API-Key: YOUR_KEY"
# {"type":"dns", "credits_used":0, "domain":"github.com",
# "records":{"A":[...], "MX":[{"exchange":"github-com.mail.protection.outlook.com","priority":0}], ...},
# "email":{"mx":true, "spf":{"record":"v=spf1 ...", "lookups":10, "all":"~"},
# "dmarc":{"policy":"quarantine", ...}, "dkim":[{"selector":"google", ...}]},
# "issues":[{"level":"info", "area":"SPF", "text":"SPF uses 10 of the 10 DNS lookups allowed. ..."}]}More free checks: SSL checker, is it down, redirect checker, HTTP header checker, website technology checker. And to see the site itself: a website screenshot.