Lookups go from your browser to Cloudflare’s public DNS resolver (or Google’s, if Cloudflare fails). Nothing is sent to this site.
What “good” looks like
| Record | The playbook’s setup |
|---|---|
| MX | Your provider’s MX, so replies arrive |
| SPF | Exactly one record, ending in ~all or -all, at most 10 DNS lookups |
| DKIM | Google: a TXT key at google._domainkey. Microsoft: two CNAMEs at selector1 and selector2 |
| DMARC | One record at _dmarc, starting at p=none, with rua= on the same domain |
Common questions
What does the checker look up?
Your domain’s MX, SPF and DMARC records, and DKIM keys at the selectors you give it (or the usual Google and Microsoft selectors). It counts SPF DNS lookups, including nested includes, against the limit of 10.
Is my domain stored?
No. Your browser asks a public DNS-over-HTTPS resolver (Cloudflare, with Google as a fallback) directly. The domain never reaches this site’s servers.
Why is DKIM “not found” when it’s set up?
DKIM keys live at a selector you have to know. Google Workspace uses “google” by default and Microsoft 365 uses “selector1” and “selector2”; other tools use their own. Find yours as s= in the DKIM-Signature header of a sent email, and enter it.
Does passing here mean my email will land in the inbox?
No. Correct DNS is the first rung, not the whole ladder. Send a test to Gmail and check “Show original”, then work through the other checks in the spam guide.