Free tool / Inbox check

Will your emails reach the inbox?

Enter your business email or website. In about ten seconds you’ll see whether Gmail and Outlook trust your mail, whether someone could send email pretending to be you — and exactly what to change.

Free, no sign-up. We read only your domain’s public DNS settings — nothing is sent to your inbox and no mail is read.

psychevus.com

2/3

Anyone can send email pretending to be psychevus.com.

Email handled byCloudflare Email Routing (forwarding only)
DNS managed atCloudflare
Allowed to send as youCloudflare

Good
Will Gmail and Outlook trust your everyday email?
Yes — your mail proves where it comes from.
Gmail requires every sender to pass SPF or DKIM, and recommends both. Messages that can’t prove their origin are the first to land in spam or be refused.
Needs work
Can someone send email pretending to be you?
Yes. Forged mail in your name is still delivered.
Fake invoices and payment requests sent “from” a real business are a common scam. A DMARC policy of quarantine or reject is what stops them.
Good
Ready to send newsletters, receipts or invoices to many people?
Yes — you meet the published sender requirements.
Google, Yahoo and Microsoft require SPF, DKIM and a DMARC record from anyone sending around 5,000 messages a day to their users; Microsoft rejects failing mail with error 550 5.7.515.

Your fix plan 1 step

01
Move DMARC from watching to protecting
DMARC is set to monitoring only (p=none). It satisfies the sender rules, but forged mail is still delivered. Once your own services pass SPF and DKIM, quarantine sends forgeries to spam.
Type
TXT
Name / Host
_dmarc
Value
v=DMARC1; p=quarantine; rua=mailto:hello@psychevus.com
- Cloudflare dashboard → your domain → DNS → Records → Add record.
- Edit the TXT record named _dmarc so it reads as shown.
- Do this only after the steps above, so your own mail keeps passing. Later, p=reject refuses forgeries outright.

DNS changes usually apply within an hour and can take up to 48. Then check again.

Get this plan by email

Every record ready to paste, in one email you can forward to whoever manages your website or IT.

Send it to the person who can fix it

The link opens the same live check — it contains only your domain, never your email.

LinkedIn X

What we found in DNS

SPF: v=spf1 include:_spf.mx.cloudflare.net ~allSPF lists the servers allowed to send as you. 1 of 10 DNS lookups used.
DKIM: cf2024-1._domainkey, s1-ionos._domainkey, s2-ionos._domainkeyYour mail carries a signature inboxes can verify. Checked: cf2024-1, google, selector1, selector2, default, k1, s1, s2, resend, s1-ionos, s2-ionos, mail, dkim.
DMARC: v=DMARC1; p=none; rua=mailto:hello@psychevus.comDMARC is set to monitoring only (p=none). It satisfies the sender rules, but forged mail is still delivered.

This check reads public DNS only. It can’t see your sending reputation, spam complaints or what your messages contain, which also affect where mail lands.

Why business emails go to spam — in plain words

Inboxes now check who you are

Gmail requires every sender to pass SPF or DKIM, and anyone sending around 5,000 messages a day to Gmail must also publish DMARC. Yahoo applies the same rules, and since May 2025 Outlook.com rejects failing high-volume mail with error 550 5.7.515. Mail that can’t prove where it comes from is the first to land in spam.

The three records, without jargon

SPF is a guest list: the servers allowed to send email for your domain. DKIM is a wax seal: a signature showing the message wasn’t forged or changed. DMARC is the instruction to inboxes: what to do with mail that fails both — deliver, send to spam, or refuse.

Why it matters beyond spam

Without a DMARC policy that quarantines or rejects, anyone can send an email that appears to come from your business — a fake invoice to your customers, a payment request to your bookkeeper. Getting this right protects the people who trust your name.

What this check can’t see

Authentication is necessary, not sufficient. Your sending reputation, complaint rate, list quality and message content also matter, and only the mailbox providers see those. The check looks for DKIM under the names providers commonly use; a key published under an unusual name may not be found.

Sources

Email sender guidelines — Gmail Help
Email sender guidelines FAQ — Gmail Help
Sender best practices — Yahoo
Outlook’s requirements for high-volume senders — Microsoft
RFC 7208 (SPF) and RFC 7489 (DMARC)

Questions people ask

Why are my emails going to spam?

The most common technical reason is missing or broken authentication: Gmail requires every sender to pass SPF or DKIM, and bulk senders also need DMARC. Mail that can’t prove where it comes from is the first to be filtered. Reputation, complaints and content matter too, but authentication comes first.

What are SPF, DKIM and DMARC, in plain words?

SPF is a guest list of servers allowed to send email for your domain. DKIM is a tamper-proof seal on every message. DMARC is your instruction to inboxes about mail that fails both: deliver it, send it to spam, or refuse it.

Do small businesses need DMARC?

Yes, if you want to stop others sending email in your name. Without a DMARC policy of quarantine or reject, anyone can send a fake invoice or payment request that appears to come from your domain.

Is DMARC p=none enough?

It satisfies the Gmail, Yahoo and Outlook sender requirements, but it doesn’t protect you: p=none only asks for reports, so forged mail is still delivered. Move to p=quarantine once your own services pass SPF and DKIM.

What does error 550 5.7.515 mean?

Outlook.com rejected your message because your sending domain didn’t meet its authentication level — SPF, DKIM and an aligned DMARC record of at least p=none. Fix whichever of the three fails.

How long do DNS changes take?

Usually minutes to an hour, occasionally up to 48 hours, depending on your DNS host and the record’s time-to-live. Run the check again after you change a record.

Why can’t the check find my DKIM key?

DKIM keys live under a name chosen by your email provider (a “selector”). The check tries the names providers commonly use. If your provider uses an unusual one, the key may exist but not be found; if you never turned DKIM on, it isn’t there.

Does this tool read my email or store my domain?

No. It reads only your domain’s public DNS records — the same records every mail server reads. No mailbox is accessed, and checks are counted only as daily totals without the domain.

Let’s make a connection.

Working on something in systems security? The contact form will start with that topic selected.

Discuss this challenge