How to check SPF, DKIM and DMARC for a list of domains

What you are actually checking

Deliverability has a dozen meanings, and the one you can check from outside a mailbox is this: does this domain have its mail authentication set up in a way that receivers accept. That is SPF, DKIM and DMARC, plus the plumbing around them. It will not tell you whether your last campaign landed in spam, but it will tell you whether you are making it hard on yourself.

The free routes

Single domain checkers. There are excellent free ones and for your own domain they are the right tool. Run one, fix what it says, move on. If that is your whole question, stop reading here and go use one.

dig by hand. Free and exact. The catch is that the raw records are not the answer; SPF and DMARC both need interpreting, and that is where the work is.

The three things people get wrong

SPF is a chain, not a record. Every include costs a DNS lookup, and the specification allows ten. Go over it and the result is a permanent error, which receivers treat as no SPF at all. A domain with a long, tidy-looking record can be silently broken, and you will only see it if you resolve the chain and count the lookups.

DKIM cannot be discovered. There is no way to list a domain's DKIM keys from outside, because the selector is arbitrary. Anyone claiming a full DKIM check from a domain name alone is guessing common selectors. That is useful, and it is a guess; a tool should say which selectors it tried and which answered, not print a green tick.

DMARC at p=none does nothing. It is a monitoring policy. Plenty of domains set it, see the green tick in a checker, and believe they are protected. A check worth having reports the policy value, not merely the presence of a record.

When you need this for a list

Three situations turn this from a one-off into a dataset. You run mail for many domains and want a monthly portfolio check. You sell to companies and want to know which prospects have broken mail authentication, which is a real conversation opener. Or you are onboarding a client and want the baseline before you touch anything.

In all three cases the shape you want is one row per domain with the policy, the verdict and the reason, so you can sort by what is worst.

What we charge for it

One deliverability report per domain, billed per domain checked at $3.00 per 1,000, so three tenths of a cent each, up to 500 domains per run. The row carries the MX and mail provider, the SPF record with the resolved lookup count against the limit of ten, the DKIM selectors that actually answered, the DMARC policy and reporting addresses, MTA-STS, TLS-RPT, BIMI and DNSSEC, plus ranked issues and a score.

For a list of a thousand prospects that is three dollars, once. If you only care about your own domain, the free checkers are genuinely fine and we would rather you used them.