Runner
Sign in

Free toolFor anyone sending email from their own domain

Is your domain ready to send email?

Type your domain. See whether SPF, DKIM and DMARC are in place, and copy the exact record to add or fix.

The lookup goes from your browser straight to Cloudflare's public DNS resolver, cloudflare-dns.com. Nothing you type is sent to Runner.

A web address or an email address works too.

A sample result is showing below. Check your own domain to see yours.

SampleA made-up bakery: northwind-bakery.example

What the sample's records say

Grade

Almost

SPF and DMARC are published. The steps below close what's left.

  • MX: Looks good
  • SPF: Looks good
  • DKIM: Not found
  • DMARC: Watching, no reports

  1. MX

    Looks good

    Where email to your domain is delivered, replies and bounces included.

    Found

    Mail for northwind-bakery.example goes to smtp.google.com, which is Google Workspace.

    1 smtp.google.com

  2. SPF

    Looks good

    The list of servers allowed to send email as your domain.

    Found

    One SPF record, ending in ~all, so mail from a server it doesn't list is marked as suspect. It uses about 1 of the 10 DNS lookups SPF allows, an estimate.

    v=spf1 include:_spf.google.com ~all

  3. DKIM

    Not found

    A signature on each message, checked against a key in your DNS.

    Found

    Not found at the common selectors. A key can still sit at a name your provider chose, so this isn't proof there's none.

    Next

    Turn DKIM on in the Google Admin console, under Apps → Google Workspace → Gmail → Authenticate email, then publish the TXT record it gives you. If DKIM is already on, your provider's DKIM page shows the selector it uses.

  4. DMARC

    Watching, no reports

    What receivers do with mail that fails SPF and DKIM, and where reports go.

    Found

    p=none: receivers report on mail that fails and still deliver it. It asks for no reports.

    v=DMARC1; p=none

    Next

    Add a report address, so you can see who sends as you. Change it to a mailbox you read:

    Name · TXT record
    _dmarc

    Full name: _dmarc.northwind-bakery.example

    Value
    v=DMARC1; p=none; rua=mailto:dmarc@northwind-bakery.example

Share your grade

Want a growth team that emails from your domain?

Add your domain to Runner, and your email lead sends from it once SPF, DKIM and DMARC pass. Runner checks the records before sending and names any that are still missing.

Build my team

Why SPF, DKIM and DMARC decide where your email lands

Inbox providers check each message against your domain's DNS before deciding where it goes. Since 2024, Gmail and Yahoo have asked everyone sending to their users to set up SPF or DKIM, and bulk senders to set up all three.

  1. SPF

    Lists the servers allowed to send email as your domain. A receiver checks the server a message came from against the list.

    v=spf1 include:_spf.google.com ~all

  2. DKIM

    Your email provider signs each message with a private key, and your DNS holds the public half, so a receiver can check the message is yours and unaltered.

    google._domainkey

  3. DMARC

    Tells receivers what to do with mail that fails both checks, from watching to refusing it, and where to send reports.

    v=DMARC1; p=none; rua=mailto:…

Records prove the mail is yours. What you send keeps the domain's reputation: volume grown gradually, mail only in the hours you choose, and no more mail to an address that bounced.Protect your sending domain

Where to add a record

Records are added where your domain's DNS is managed, usually where you bought the domain. Add each one as a TXT record, with the name and value from your result.

  • Cloudflare

    Your domainDNSRecordsAdd record

  • GoDaddy

    Domain PortfolioYour domainDNSAdd New Record

  • Namecheap

    Domain ListManageAdvanced DNSAdd New Record

  • Squarespace

    DomainsYour domainDNSCustom records

  • Amazon Route 53

    Hosted zonesYour domainCreate record

  • Most hosts want the name without your domain on the end: @ for the domain itself, and _dmarc rather than _dmarc.yourshop.com. Your result shows both.
  • A new record usually shows within minutes of saving it. Check again here once it's in.

What this check doesn't see

  • It reads public DNS. It sends no test message, so it doesn't see whether your mail is signed as it leaves, or how a receiver scores it.
  • DKIM keys sit at names your provider chooses. The check tries the common ones, so a key at any other name reads as not found.
  • The SPF lookup count is an estimate, worked out from your records as they read today.

Questions about the Email Readiness Check

Is my domain sent to Runner?

No. Your browser asks Cloudflare's public DNS resolver for your domain's public records, and this page reads the answers. Nothing you type is sent to Runner or kept: close the page and it's gone.

What does Cloudflare see?

The names looked up, which are your domain, its _dmarc name and the DKIM names tried, and your IP address, as with any DNS lookup. The records themselves are public: anyone can look them up.

Why does it say DKIM wasn't found?

A DKIM key sits at a name your provider chooses, called a selector. The check tries the common ones, and a key at any other name reads as not found. Your provider's DKIM settings show the selector it uses.

How is the grade worked out?

Ready means MX, SPF and DKIM look good and a DMARC record is published. Not yet means SPF or DMARC is missing or broken, because receivers treat either as no record at all. Almost is everything between. A DMARC policy of p=none counts as published.

How long does a new record take to show?

Usually minutes once it's saved at your DNS host, though a change can take longer to reach every resolver. Check again here after saving it.

What keeps a sending domain's reputation once the records are in?

What you send: volume grown gradually, mail only in the hours you choose, and no more mail to an address that bounced or complained.

Protect your sending domain
Does it cost anything?

No. There's no account and nothing to sign up for.

What does Runner add?

A growth team. Its email lead drafts emails and sends them from your domain once SPF, DKIM and DMARC pass. Nothing goes out until you approve it or switch the team on.

Cloudflare, GoDaddy, Namecheap, Squarespace, Amazon Route 53, Google Workspace, Gmail, Microsoft 365 and Yahoo are trademarks of their owners. Runner is not affiliated with or endorsed by them.All free tools