Postpass
Type your domain. Postpass reads its live DNS, tells you exactly what’s wrong with your SPF, DKIM, and DMARC, and gives you the corrected records to paste — so your mail reaches the inbox and no one can spoof you.
Three small DNS settings decide whether your email reaches inboxes or gets marked as spam:
Postpass checks all three and, if anything’s wrong, hands you the exact record to paste. Takes about five seconds — nothing to install.
Why it's better
Other checkers tell you that you failed and leave you to it. Postpass hands you the exact SPF and DMARC records to paste — SPF merged, deduped, and kept under the 10-lookup limit — plus where each one goes.
No upload, no account, nothing stored. It looks up your domain’s public DNS on your device — the same records any mail server checks.
It reads your real DNS and never turns a lookup error into a false verdict. It confirms DKIM when it can see it, and honestly flags “couldn’t verify” when a custom setup might exist — no crying wolf.
Questions
Usually because receivers can't confirm the mail is really from you. Three DNS records do that: SPF lists which servers may send as your domain, DKIM signs each message, and DMARC ties them together and says what to do on failure. If any is missing or misconfigured, spam filters distrust you — and since 2024 Gmail and Yahoo outright reject bulk mail that lacks them. Postpass checks all three and hands you the fix.
There's no sign-up and nothing is stored. Postpass looks up your domain's public DNS straight from your browser via a public DNS-over-HTTPS resolver — the same lookups any mail server does. It only ever reads public records for the domain you type; it never sees your mailbox or your mail.
For SPF and DMARC it generates the exact corrected record for you to paste, including keeping SPF within the 10-lookup limit. For DKIM it detects whether signing is set up and links you to your provider to turn it on — it can't generate the key for you, because DKIM's private key lives at your email provider (that's what makes the signature trustworthy).
It reads your real, live DNS — not a cached guess — and if a lookup fails it tells you to retry rather than pretend a record is missing. It can confirm DKIM is present, but it can't prove a custom-selector DKIM is absent, so it flags that as “couldn't verify”, never a false “broken”. The goal is to never tell you something is wrong when it isn't.
Every service you add to SPF (Google, Mailchimp, your CRM…) costs DNS lookups, and the spec allows only 10. Go over and SPF fails silently — even though the record looks fine. Postpass counts the lookups the way receivers do, and builds you one record, from the senders you actually use, that stays under the limit.
DNS changes take a few minutes to a few hours to spread, and public resolvers cache each record until its TTL expires. Give it a little time, then hit Re-check.