Free DNS checker for email authentication
Look up SPF, DKIM, DMARC, and MX records for your domain. The checker runs in your browser and queries public DNS.
What each record does
SPF (Sender Policy Framework) uses a DNS TXT record to list the servers authorized to send for a domain. Receiving servers check the connecting sender’s IP address against that record. Loops supplies its SPF record at envelope.yourdomain.com, separate from an SPF record at your root domain.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to email. Receiving servers use the public key in DNS to check that the signed content has not changed. DKIM records live at selector._domainkey.yourdomain.com. The checker probes common selectors and lists the keys it finds. For randomized selectors, including those used by Loops, get the exact hostname from your domain records page. Loops signs email with DKIM from your first send.
DMARC (Domain-based Message Authentication, Reporting and Conformance) lets a domain owner request handling for mail that fails both aligned SPF and aligned DKIM. A DMARC record sits at _dmarc.yourdomain.com and carries a policy: p=none requests no DMARC-specific enforcement, p=quarantine asks receivers to treat failing mail as suspicious, and p=reject asks receivers to reject it. Receivers still apply their own policy. An organizational-domain policy can cover subdomains that have no policy of their own. Create one with the DMARC record generator.
This checker looks up MX records for the exact hostname you enter. Your domain’s inbound MX records route mail to your inbox provider. Loops uses a separate MX record on the custom MAIL FROM subdomain shown in your domain settings to route delivery feedback. A missing Loops setup record does not mean your main domain cannot receive email.
How to fix a missing record
For Loops records, open Settings → Domain and click View records. Copy the SPF, DKIM, MX, and default DMARC records into your DNS provider. Match each record’s Type (TXT, MX, or CNAME) rather than the label, then click Verify Records. For instructions by DNS provider, see Setting up your domain.
The DMARC and DKIM setup guide explains how to check authentication before moving your policy from p=none to p=quarantine to p=reject.
If authenticated mail still lands in spam, check your sending reputation, list quality, and message content. See why emails go to spam and the broader email deliverability guide.
If you find more than one SPF policy at the same hostname, follow the multiple SPF records fix. It also covers Google Workspace’s root SPF record and Loops’ envelope subdomain.
FAQ
How long until new records show up here?
DNS caches refresh according to the record’s TTL and resolver caching. Changes may appear within hours, but Loops advises allowing up to 72 hours. Recheck the exact hostname; some records may become visible before others.
How does the DKIM check work?
The checker probes 20 common selector names and lists any DKIM keys it finds. A record lives at selector._domainkey.yourdomain.com. Randomized selectors, including those used by Loops, cannot be found by trying common names. Get the exact DKIM hostnames from your domain records page.
Do I really need a DMARC record?
DMARC lets you request handling for messages that fail both aligned SPF and aligned DKIM. Gmail requires DMARC for bulk senders: roughly 5,000 or more messages to personal Gmail accounts in 24 hours. Loops supplies a default record during setup. Start with p=none and a report address, then review legitimate senders before moving to p=quarantine or p=reject. Receivers can still apply their own policy.
My records all pass but email still goes to spam. Why?
Authentication is one part of inbox placement. Sending reputation, list quality, and message content also affect filtering. See why emails go to spam for troubleshooting. The subject line tester previews how a subject reads in the inbox; it does not predict delivery.
What's next
Related reading and free tools.