Free checkers - no signup
Email authentication for form notifications
Form notification emails need SPF, DKIM and DMARC because they are sent from your domain, and receiving mail servers use those records to decide whether the message is allowed and unaltered. Check the domain in your From address with the SPF, DKIM and DMARC checkers below, then fix the record that fails.
This hub explains what each check proves, what it cannot verify, and which free checker to run. For the full setup order and the alignment mistakes that cause failures, read the email authentication guide for form notifications.
p=none with reporting. Then check alignment, read the reports, and tighten the policy. Authentication helps receivers trust the message, but it does not guarantee inbox placement.Which checker to run
Each checker reads public DNS for the domain you enter. Use the domain after the @ sign in your form's From address, not the visitor's address. For DKIM you also need the selector from a real message header.
| Checker | What it checks | What it cannot verify |
|---|---|---|
| SPF checker | Reads the domain's SPF TXT record, explains each mechanism, and estimates DNS lookups against the 10-lookup limit. | Cannot prove the sending server actually used that path, and cannot see whether the message reached the inbox. |
| DKIM checker | Takes a domain and selector, shows the published public key, and flags revoked or short keys. | Cannot verify a specific message signature or tell you which selector your provider used without the message header. |
| DMARC checker | Reads the _dmarc record, explains the policy and every tag, and flags p=none, partial pct or missing reports. | Cannot show whether a real message aligned, and cannot read the aggregate reports sent to your reporting address. |
| Email deliverability checker | Combines SPF, DMARC and MX results for a domain into a pass, warning or fail summary with a one-line fix. | Cannot measure sender reputation, content filtering, complaint rates or inbox placement. |
The checkers show what is published, not what a recipient's mail server decides. If a form submits but the notification never arrives, work through the contact form deliverability diagnostic in order: recipient address, spam or quarantine folder, sender configuration, then the form backend log.
What SPF, DKIM and DMARC each do
SPF lists the servers and services allowed to send mail for your domain. For form notifications, the sending server must be on that list, or receivers have less reason to trust the message.
DKIM adds a cryptographic signature that receivers verify against a public key in DNS. A correct signature also survives many forwarding paths, where SPF can break.
DMARC ties SPF and DKIM to the From domain and tells receivers what to do when neither passes. A monitoring policy with reporting shows you which senders are failing before you tighten it.
Frequently asked questions
Why do form notification emails need SPF, DKIM and DMARC?
A form notification is sent from your domain, so receiving mail servers check whether that domain authorises the sending server. SPF lists the allowed servers, DKIM proves the message was signed by your provider and not altered, and DMARC ties both to the From domain. Without them, a legitimate notification looks the same as a spoofed message and is more likely to be filtered or quarantined.
Which SPF record should my form backend use?
Use one SPF TXT record on the domain in your From address and include the service that sends the notification. If your form backend sends through its own mail service, add that service's include mechanism. Keep a single v=spf1 record, stay within the 10 DNS lookup limit, and use ~all while you test before moving to -all.
How do I check DKIM for form notification email?
Open a real notification and read the DKIM-Signature header. The selector is the value after s=, and the signing domain is the value after d=. Enter that domain and selector in the DKIM checker to see the published public key. A missing record, a revoked key or a selector that does not match the header makes DKIM fail even when the message is legitimate.
Why does DMARC fail when SPF and DKIM pass?
DMARC requires alignment, not just a pass. The domain that passes SPF or DKIM must match the domain in the From address. A common cause is a form backend that sends From your domain but authenticates a shared sending domain. Compare the From domain with the authenticated domain, then fix the sender configuration or add the correct DKIM signing domain.
Does passing these checks guarantee form emails reach the inbox?
No. The checkers read public DNS, so they show what is published, not what a recipient's mail server decides. Inbox placement also depends on sender reputation, message content, complaint rates, recipient filters and sending volume. Authentication removes one common reason for rejection; it is not a delivery promise.
Next: run the SPF checker, DKIM checker and DMARC checker, or read the full email authentication guide.