PayFlowFix.dev
free tool · no sign-up

SPF, DKIM & DMARC checker

Paste a domain. Get the SPF chain expanded lookup by lookup against the 10-lookup limit, the DKIM selectors that actually exist, the DMARC policy in plain language — and a record you can paste straight into your DNS panel.

Runs in your browser against Cloudflare and Google DNS-over-HTTPS. Nothing is sent to this site's server, and nothing is stored.

Advanced — add a DKIM selector
why this exists

Three records decide whether your invoices get read

Email authentication is the part of a payment flow nobody owns until it breaks. These are the failures that show up in support tickets rather than logs.

01 / spf Your SPF quietly stopped working

You added one more provider and crossed 10 DNS lookups. Receivers now return permerror and treat your domain as having no SPF at all. Nothing bounced, nothing logged — receipts just started landing in spam.

02 / dkim Forwarded mail fails even though SPF passes

SPF breaks the moment a message is forwarded. DKIM is the signature that survives it. Without DKIM, a customer forwarding your invoice to their finance team turns it into a DMARC failure.

03 / dmarc Anyone can send an invoice as you

No DMARC record, or p=none forever, means a spoofed "updated bank details" email from your domain arrives looking exactly like yours — and you never find out it happened.

faq

Straight answers

Does my domain data get sent to your server?
No. The checker runs entirely in your browser and queries Cloudflare and Google DNS-over-HTTPS directly. This site is static files — there is no backend to log what you check. That is also why there is no rate limit or sign-up.
Why do you not check DNS blocklists like Spamhaus?
Because the answer would be wrong. Spamhaus refuses queries that arrive via public resolvers such as Cloudflare and Google, and returns a special "open resolver" code instead of a real result. A browser-based tool has no way around that, so rather than show you a confident-looking false negative, we send you to Spamhaus directly.
You said you found no DKIM key. Does that mean I have none?
Not necessarily. DKIM selector names are chosen by whoever set up sending, and DNS provides no way to list which selectors exist on a domain — you can only guess and check. We probe roughly 45 selectors that real hosts and providers use by default. If your platform documents a selector, enter it under Advanced and re-run.
What is the 10-lookup SPF limit, and why does it matter so much?
RFC 7208 lets a receiver perform at most 10 DNS lookups while evaluating your SPF record. Every include:, a, mx, ptr and exists term costs one, and terms inside the records you include count too. Go over and receivers return permerror, which means they treat your domain as if it had no SPF record at all. Mail that used to pass starts failing, with no bounce message pointing at the cause.
Can I just flatten my SPF record to fix the lookup limit?
You can, and this tool will generate a flattened record if you ask for it — but it is the last resort, not the first. Flattening replaces include: with your provider's current IP ranges, which freezes a snapshot. When the provider changes ranges, your mail starts failing and nothing in your DNS hints at why. Moving bulk mail to a subdomain gives you a second 10-lookup budget and does not rot.
Is p=none good enough for DMARC?
It is the correct place to start and the wrong place to stop. p=none asks receivers to report on forged mail but to deliver it anyway, so it protects nothing. Run it for two to four weeks until your aggregate reports only show senders you recognise, then move to quarantine with a low pct, then to reject.
What does this have to do with payment integrations?
Payment flows fail in two ways that look identical to a customer: the money moved but your system never found out (a webhook problem), or your system knows but the customer never got told (an email problem). This tool covers the second one for free. If your receipts and invoices are authenticated correctly and customers still are not being notified, the fault is in the webhook or status-sync layer — which is what I fix for a fee.

Still broken after the DNS is right?

Email authentication is DNS. Payment notifications not arriving is usually not — it is a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced. That is what I fix: a fixed-fee $99 root-cause diagnosis, credited toward the repair.

Get a $99 diagnosis What I fix