Free Domain Validator: Check MX, SPF and DMARC Records

A domain needs four DNS records to send and receive email reliably: NS, MX, SPF and DMARC, with DKIM as the fifth. NS records prove the domain is actively managed and point at the nameservers that answer for it. MX records name the mail servers that accept incoming mail. An SPF record, a TXT record at the domain root starting with v=spf1, lists which servers are allowed to send as that domain. A DMARC record, a TXT record at _dmarc.yourdomain.com, tells receivers what to do when authentication fails. Cleanlist AI's free domain validator queries all four live, against the domain's authoritative nameservers, and returns the raw records alongside a 0-100 score.

An MX record is a DNS entry that names a mail server responsible for accepting email on behalf of a domain, together with a priority number where lower means preferred. A domain with no MX record cannot receive email at all, which makes a missing MX the most decisive signal a domain validator can return. Multiple MX records give a domain failover: if the priority 10 host is unreachable, the sending server tries the priority 20 host. Cleanlist AI's free domain validator returns the full set sorted by priority, so you can see whether a prospect runs Google Workspace, Microsoft 365, or a self-hosted server, which in turn tells you how likely that domain is to be configured as a catch-all.

An SPF record is a TXT record published at a domain's root that lists the servers permitted to send email using that domain, and it always begins with v=spf1. A receiving server reads it, compares it to the IP the message arrived from, and decides whether the sender is authorised. The record ends with a policy: -all means reject anything not listed, ~all means treat it as suspicious, and +all effectively disables the check. Google's sender guidelines require every sender to set up SPF or DKIM for its sending domains, so a domain with neither is not meeting the published bar. Cleanlist AI's free domain validator returns the raw SPF string so you can read the policy for yourself.

DKIM is a cryptographic signature added to outgoing mail that lets a receiving server confirm the message really came from the domain it claims and was not altered in transit. The sending server signs each message with a private key; the receiver fetches the matching public key from a DNS TXT record at selector._domainkey.yourdomain.com and checks the signature. Yahoo's Sender Hub specifies a DKIM key length of 1024 bits or greater, and recommends 2048 bits. Cleanlist AI's free domain validator does not check DKIM, because the lookup needs the selector name, which is chosen by whoever configured the mail service and cannot be guessed from the domain alone.

DMARC is a TXT record at _dmarc.yourdomain.com that tells receiving servers what to do with mail claiming to be from that domain when SPF and DKIM fail, and where to send reports about it. The policy is set by the p= tag and has three values: p=none monitors and takes no action, p=quarantine sends failures to spam, and p=reject refuses them outright. Google requires senders of 5,000 or more messages a day to Gmail to publish a DMARC policy, and Yahoo urges every sending domain to publish one. Cleanlist AI's free domain validator fetches the record and surfaces the policy value, so you can tell a domain that is genuinely protected from one that merely has a record on file.

It means two different things depending on whose domain is failing. If your own sending domain has no DMARC record, or has p=none, you are below the bar Google publishes for senders of 5,000 or more messages a day to Gmail, and Yahoo urges a published policy for every sending domain. Expect throttling and spam placement as volume rises. If a prospect's domain has no DMARC, the risk is different: that domain is spoofable, replies you receive from it are harder to trust, and its mail infrastructure is likely unmanaged, which correlates with stale contact records. Cleanlist AI's free domain validator flags a missing DMARC as a warning rather than an error, because internal-only and parked domains legitimately do without one.

Google requires all senders to set up SPF or DKIM authentication for their sending domains, transmit over TLS, publish valid forward and reverse DNS records, and keep the spam rate reported in Postmaster Tools below 0.3%, with a recommended target below 0.10%. Senders of 5,000 or more messages a day to Gmail accounts must additionally set up both SPF and DKIM, publish a DMARC policy, and support one-click unsubscribe on marketing mail. Yahoo requires one-click unsubscribe under RFC 8058 for promotional messages, enforced since June 2024, specifies a DKIM key of 1024 bits or greater with 2048 recommended, urges a published DMARC policy on every sending domain, and states that it will not specify a volume threshold for what counts as a bulk sender.

A domain's DNS setup decides whether mail is authenticated before a receiving server ever looks at the content. SPF and DKIM establish that the message came from a server allowed to send as that domain; DMARC tells the receiver what to do when they fail and lets the domain owner see who is sending on its behalf. Without them a message arrives unauthenticated, which is the same posture a spoofer has, and filters treat it accordingly. Domain setup is only half the picture: Google measures spam complaint rate independently of authentication, so a fully authenticated domain sending to a stale list still gets throttled. Cleanlist AI's free email verifier handles the other half, checking whether the recipient address can receive mail at all.