coldemailinboxes.io
TOOL: DNS RECORDS CHECKER

Free DNS Records Checker

Check a domain's SPF, DKIM, DMARC and MX records in one pass, or paste a list to audit up to 100 domains at once.

Options

What this checker does

It runs four checks against a domain in a single pass - SPF, DKIM, DMARC and MX - and returns a verdict for each rather than one combined result, so a failure points straight at the record that caused it.

DKIM is the awkward one: keys are published under a selector chosen at setup, and DNS offers no way to list them. The checker probes 57 selectors used by common providers, and accepts a custom selector for anything outside that set.

Bulk mode takes up to 100 domains at once and exports the results as CSV, which is the practical way to audit a batch of sending domains before loading them into a sequencer.

Reading the result

SPF should authorize your sending platform and stay inside ten DNS lookups. Above roughly seven, treat the next vendor addition as a risk.

DKIM needs at least one valid key. A key with an empty p= value has been revoked and carries no key material, which is not the same as a key being present.

DMARC must be at _dmarc. as a subdomain. Publishing it at the root is the most common setup error and leaves the domain with no policy at all.

MX shows where mail is delivered. For Microsoft 365, expect a single host ending mail.protection.outlook.com.

Failures that look fine

DKIM found on every selector probed. Some zones answer every *._domainkey query with an empty record. That is not 57 keys; it is a wildcard and no usable key at all.

Authentication on the wrong domain. Cold email runs on dedicated sending domains. Records on the primary domain do nothing for a campaign sending from another one.

Checked too early. DNS changes propagate as caches expire. A record added minutes ago may not be visible yet, which is not the same as being wrong.

Common questions

DKIM keys live at selector._domainkey.yourdomain.com, and the selector is chosen by whoever set the domain up, so there is no way to enumerate it from DNS alone. The checker probes 57 selectors used by common providers, which covers most real configurations. A custom selector can be supplied directly if yours is not among them.

It accepts up to 100 domains at once, runs the same four checks against each, and exports the results as CSV. It is built for auditing a batch of sending domains before a campaign rather than checking them one at a time.

An SPF record authorizing the sending platform and well inside the ten-lookup limit, at least one valid DKIM key, a DMARC policy at _dmarc, and MX records pointing at the mail provider. All four passing is the baseline before any volume.

Authentication is a prerequisite, not a guarantee. With all four correct, the next causes are sending volume outpacing domain reputation, list quality, and content. Reputation is built by sending slowly to engaged recipients, and no DNS record substitutes for it.

Before a domain sends anything, and again whenever DNS is touched or a sending platform is added. SPF in particular breaks silently when a vendor expands their own includes and pushes the record past ten lookups.

Related