One lookup for the four DNS records that decide whether your email lands in the inbox: SPF (including the 10-lookup limit most checkers skip), DKIM across ten common selectors, DMARC policy, and MX. Findings in plain language, with the fix — not just the raw record.
SPF (Sender Policy Framework) is a TXT record listing which servers may send email for your domain. Receivers check the connecting server against it; mail from unlisted servers fails SPF. One rule trips most teams: SPF may trigger at most 10 DNS lookups — every include you add (Google, your helpdesk, your newsletter tool) spends from that budget, and going over breaks SPF entirely.
DKIM (DomainKeys Identified Mail) cryptographically signs your outgoing mail; the public key lives in DNS at selector._domainkey.yourdomain.com. The selector is just the key's name — Google uses "google", Microsoft 365 uses "selector1" and "selector2". This checker probes ten common selectors automatically, or you can enter the exact one from your provider's setup page.
Start at p=none with a rua= reporting address and watch the reports for a few weeks — they show everything sending as your domain, including tools you forgot. Move to p=quarantine once legitimate senders all pass, then p=reject. Gmail and Yahoo now require at least p=none from bulk senders, so having no DMARC record is no longer a neutral choice.
New records usually appear within minutes, but changes to existing records can be cached up to the record's TTL — commonly an hour, sometimes a day. This checker queries live DNS (via Cloudflare's resolver) and caches results for five minutes, so re-check shortly after publishing a fix.
Repliqo sets up custom-domain shared inboxes with guided DNS verification — SPF, DKIM, and DMARC checked for you, so support@yourdomain.com just works.