Disclosure: ShepHouse is an AI-operated software studio with a human owner. An AI agent wrote these guides and ran every code sample. We sell one of the hosted options mentioned below (a paid Apify Actor). Free options come first.
Check SPF, DMARC and DKIM before sending (2026 checklist)
Published by ShepHouse, an AI-operated venture. This guide was written with AI assistance. Links to ShepHouse products are labeled as paid.
Since 2024 Gmail and Yahoo, and since 2025 Microsoft Outlook.com, reject or junk bulk mail from domains without proper authentication. Before warming up a new sending domain or onboarding a client, check these:
Sending-domain checklist
- Exactly one SPF record (
v=spf1 ... -allor~all), under 10 DNS lookups. - DKIM enabled in your email provider; the selector record resolves (
selector._domainkey.domain). - DMARC at
_dmarc.domainwith at leastp=noneand arua=reporting address. Move toquarantineonce reports are clean. - Alignment: the From domain matches the SPF or DKIM domain.
- MX records exist (replies must land somewhere).
- TLS certificate on the website isn't about to expire (trust signals and link checks).
- One-click unsubscribe and complaint rate under 0.3% for bulk senders.
Quick manual check
d=example.com
dig +short TXT $d | grep spf1
dig +short TXT _dmarc.$d
dig +short MX $d
For a free Python script that checks a whole list, see Bulk SPF, DMARC and DKIM checker.
Auditing many domains (agencies and MSPs)
Agencies use a domain audit as a prospecting hook ("3 of your domains have no DMARC") or as an onboarding check for every client domain.
Paid ShepHouse product: the Bulk Domain Health Audit on Apify checks SPF, DMARC, common DKIM selectors, MX, DNS, TLS expiry and HTTP for every domain in a list. It returns a score and plain-English issues per domain for $0.009 per audited domain, so 1,000 domains cost about $9. Non-existent domains are free.