Your result
The result says whether your domain publishes a valid SPF record, a DKIM key under the selectors of your provider and a DMARC policy, then lists the fixes in order and the guides of your provider.
In doubt? Send me your domain name and your host, and I tell you within 24 hours what is missing and what to do. Free, no commitment.
Send my domain nameRather have me handle it? SPF, DKIM and DMARC set up in your DNS zone (OVH, o2switch, IONOS, Gandi, Infomaniak…), existing SPF record merged, DKIM enabled at each sending service, test emails and a written report. Free diagnosis, set-up on quote, reply within 24 hours.
Request a quoteOrange, the largest consumer mailbox provider in France, now requires SPF, DKIM and DMARC from every sender, whatever the volume (rules updated on 1 September 2026). laposte.net has asked for the three since September 2025, iCloud too, and Gmail has been rejecting more and more unauthenticated messages since November 2025. A small business that sends its quotes and invoices from its own domain name is concerned from the very first email. This tool reads the public DNS records of your domain, recognises your mailbox provider and your sending services, looks for the DKIM key under their selectors, and tells you what is missing and in which order to fix it.
Tool built by Léo Guillaume, freelance developer near Rennes, France. I set up the email sending of the websites, online stores and business software I deliver to small businesses, remotely, and I reply within 24 hours.
Updated on
What mailbox providers require
Every major mailbox provider has published its rules. Here they are as written, with the date and the official page, without drama. For a small business in France, the first two lines matter more than the next ones.
1 September 2026
The postmaster page of Orange, updated on 1 September 2026, asks that all three mechanisms pass: SPF required, DKIM required (an unsigned message may be rejected), DMARC required. No volume threshold: the rules apply to everyone. Error codes 515 (DMARC), 519 (SPF) and 535 (DKIM) point to these settings.
Source: postmaster.orange.fr, update of 1 September 20269 September 2025
The postmaster of laposte.net announced on 22 August 2025 that every sender to laposte.net, “individuals, businesses or senders of transactional or marketing messages”, must implement SPF, DKIM and DMARC, with no volume threshold. Emails that fail “will be considered spam”. There is no official page: the source is the announcement relayed by dmarcian.
Source: dmarcian (FR), 3 September 2025, updated 11 November 20251 February 2024
Since 1 February 2024, every sender to Gmail must set up SPF or DKIM, publish a valid PTR record, encrypt with TLS, stay under a 0.3% spam rate and sign with a DKIM key of at least 1,024 bits. From 5,000 messages a day to personal Gmail accounts: SPF and DKIM, DMARC (p=none accepted), alignment and one-click unsubscribe. Since November 2025, non-compliant messages are progressively rejected.
Source: Google, email sender guidelines and requirements FAQ5 May 2025
“Effective May 5th, 2025”, domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live must pass SPF, DKIM and DMARC (at least p=none, reject recommended), aligned. Non-compliant messages go to the junk folder first, then are refused with error 550 5.7.515. Below the threshold, Microsoft “strongly recommends” all three to every sender.
Source: Outlook.com Postmaster, Policies, Practices and Guidelines25 February 2025
The Apple page for senders asks for SPF, DKIM, a DMARC policy published by the sending domain, reverse DNS and an unsubscribe link, with no volume threshold or complaint rate figure. Key sentence: “All requirements must be met in order to send a bulk email. If not, the email will be rejected.”
Source: Apple, iCloud Mail – Best practices for senders7.8%
Among .fr domains with a receiving server, 57.8% publish an SPF record, 23.1% at least one DKIM key and 7.8% a DMARC record. Among those DMARC records, 73.6% are at p=none: only 1.3% of the .fr zone is at p=reject. Technical SPF errors are rare: fewer than 2.3% of policies too permissive, 0.005% above 10 lookups.
Source: AFNIC, study of 21 March 2023For a small business sending 50 emails a day: in France, your customers have @orange.fr, @wanadoo.fr, @laposte.net or @icloud.com addresses. For them, “SPF or DKIM” is not enough, all three are needed, from the first email. The 5,000-messages-a-day threshold of Google and Microsoft only concerns their own mailboxes: it does not protect you. The verdict of the tool therefore targets SPF, DKIM and DMARC, with at least p=none and a reporting address.
What the tool checks
Nothing is sent: the tool queries the public DNS servers of your domain, follows the includes of the SPF record, probes the known DKIM selectors and decodes the key found. It also recognises your mailbox provider from the MX hosts and your sending services from the SPF record, to give you the right guides.
A single TXT record starting with v=spf1, the servers allowed to send in your name, at most 10 DNS lookups counting the includes, an ending in ~all or -all, no include that fails to resolve, and the include of your mailbox provider.
The public key under <selector>._domainkey, looked for under the selectors documented by your provider (google, selector1, default, gm1, s1-ionos, protonmail…) and the most common ones, then decoded: at least 1,024 bits, no revoked key (empty p=), no test mode (t=y).
The TXT record under _dmarc: a single record, v=DMARC1 first, a policy p=none, quarantine or reject, the pct percentage, the rua reporting address and, when it is on another domain, the _report._dmarc authorisation that lets recipients send the reports.
By provider
The tool recognises your mailbox provider from the MX hosts of your domain and your sending services from the includes of your SPF record, then probes the selectors each one documents. When the selector is generated per account (OVH, Amazon SES) or chosen by you (Zoho), it cannot be guessed: read it in the DKIM-Signature header of a sent email.
| Provider | How it is recognised, DKIM selectors | Official guide |
|---|---|---|
| Google Workspace | MX smtp.google.com or aspmx.l.google.com, include:_spf.google.com. Selector google (2,048-bit key recommended). | Set up DKIM at Google |
| Microsoft 365 | MX in .mail.protection.outlook.com, include:spf.protection.outlook.com. Selectors selector1 and selector2, as CNAME. | Set up DKIM at Microsoft |
| OVHcloud | MX mx0 to mx4.mail.ovh.net, include:mx.ovh.com. Selectors ovhmo<id>-selector1 and 2, specific to the account: not guessable, enabled automatically. | Set up DKIM at OVHcloud |
| o2switch | MX in your own domain, recognised from include:spf.jabatus.fr. Selector default, 2,048-bit key generated by cPanel. | SPF, DKIM and DMARC at o2switch |
| IONOS | MX mx00 and mx01.ionos.com or .ionos.fr, include:_spf-eu.ionos.com. Selectors s1-ionos, s2-ionos, s42582890, automatic with the IONOS name servers. | Set up DKIM at IONOS |
| Gandi | MX spool and fb.mail.gandi.net, include:_mailcust.gandi.net. Selectors gm1, gm2 and gm3, as CNAME. | Anti-spoofing at Gandi |
| Infomaniak | MX mta-gw.infomaniak.ch, include:spf.infomaniak.ch. Selector not documented, generated in the Manager (Global security, DKIM). | DKIM records at Infomaniak |
| Proton Mail | MX mail and mailsec.protonmail.ch, include:_spf.protonmail.ch. Selectors protonmail, protonmail2 and protonmail3, as CNAME. | Anti-spoofing at Proton |
| Zoho Mail | MX mx, mx2 and mx3.zoho.eu or .zoho.com, include:zoho.com or one.zoho.eu. Selector chosen by the administrator (zoho, zmail…). | Set up DKIM at Zoho |
| Hostinger | MX mx1 and mx2.hostinger.com, include:_spf.mail.hostinger.com. Selectors hostingermail-a, -b and -c, as CNAME. | Set up a domain at Hostinger |
| LWS | include:_spf.lws.fr, MX in .lws.fr or .lwspanel.com (not documented). Selector default, key generated by cPanel. | SPF, DKIM and DMARC at LWS |
| Orange Pro | MX in .orange.fr or .orange-business.com (values depend on the plan, not published). No documented selector: ask support. | Orange postmaster rules |
| Brevo | include:spf.brevo.com or spf.sendinblue.com. Selectors brevo1 and brevo2 as CNAME, old format mail._domainkey as TXT. | Authenticate a domain at Brevo |
| Mailjet | include:spf.mailjet.com. Selector mailjet, as TXT. | SPF and DKIM at Mailjet |
| Mailchimp | include:servers.mcsv.net. Selectors k2 and k3 as CNAME (k1 for the old format); Mandrill: mte1 and mte2. | Authenticate a domain at Mailchimp |
| SendGrid | include:sendgrid.net. Selectors s1 and s2, as CNAME to sendgrid.net. | Authenticate a domain at SendGrid |
| Amazon SES | include:amazonses.com (with a custom MAIL FROM domain). Three randomly generated selectors: not guessable, read them in the header of a sent email. | Easy DKIM at Amazon SES |
MX smtp.google.com or aspmx.l.google.com, include:_spf.google.com. Selector google (2,048-bit key recommended).
Set up DKIM at GoogleMX in .mail.protection.outlook.com, include:spf.protection.outlook.com. Selectors selector1 and selector2, as CNAME.
Set up DKIM at MicrosoftMX mx0 to mx4.mail.ovh.net, include:mx.ovh.com. Selectors ovhmo<id>-selector1 and 2, specific to the account: not guessable, enabled automatically.
Set up DKIM at OVHcloudMX in your own domain, recognised from include:spf.jabatus.fr. Selector default, 2,048-bit key generated by cPanel.
SPF, DKIM and DMARC at o2switchMX mx00 and mx01.ionos.com or .ionos.fr, include:_spf-eu.ionos.com. Selectors s1-ionos, s2-ionos, s42582890, automatic with the IONOS name servers.
Set up DKIM at IONOSMX spool and fb.mail.gandi.net, include:_mailcust.gandi.net. Selectors gm1, gm2 and gm3, as CNAME.
Anti-spoofing at GandiMX mta-gw.infomaniak.ch, include:spf.infomaniak.ch. Selector not documented, generated in the Manager (Global security, DKIM).
DKIM records at InfomaniakMX mail and mailsec.protonmail.ch, include:_spf.protonmail.ch. Selectors protonmail, protonmail2 and protonmail3, as CNAME.
Anti-spoofing at ProtonMX mx, mx2 and mx3.zoho.eu or .zoho.com, include:zoho.com or one.zoho.eu. Selector chosen by the administrator (zoho, zmail…).
Set up DKIM at ZohoMX mx1 and mx2.hostinger.com, include:_spf.mail.hostinger.com. Selectors hostingermail-a, -b and -c, as CNAME.
Set up a domain at Hostingerinclude:_spf.lws.fr, MX in .lws.fr or .lwspanel.com (not documented). Selector default, key generated by cPanel.
SPF, DKIM and DMARC at LWSMX in .orange.fr or .orange-business.com (values depend on the plan, not published). No documented selector: ask support.
Orange postmaster rulesinclude:spf.brevo.com or spf.sendinblue.com. Selectors brevo1 and brevo2 as CNAME, old format mail._domainkey as TXT.
Authenticate a domain at Brevoinclude:spf.mailjet.com. Selector mailjet, as TXT.
SPF and DKIM at Mailjetinclude:servers.mcsv.net. Selectors k2 and k3 as CNAME (k1 for the old format); Mandrill: mte1 and mte2.
Authenticate a domain at Mailchimpinclude:sendgrid.net. Selectors s1 and s2, as CNAME to sendgrid.net.
Authenticate a domain at SendGridinclude:amazonses.com (with a custom MAIL FROM domain). Three randomly generated selectors: not guessable, read them in the header of a sent email.
Easy DKIM at Amazon SESYour provider is not in the list? The tool still probes about twenty common selectors (default, google, selector1, mail, dkim, s1, k1…). If it finds nothing, search for “DKIM” in the help of your provider, or send me its name with your domain: I look within 24 hours.
In order
The same path at OVH, o2switch, IONOS, Gandi or Infomaniak: everything happens in the DNS zone of the domain and in the admin area of each service that sends in your name. Count an hour, then a few weeks of reports before hardening DMARC.
List everything that sends in your name: the mailbox, the quoting and invoicing software, the newsletter, the website form. A single TXT record at the root of the domain, v=spf1, the include of each service, then ~all. Check that the whole stays under 10 DNS lookups, includes counted.
Every service that sends must sign: enable DKIM in its admin area (at Google Workspace, wait 24 to 72 hours after Gmail is enabled to get the key), then publish the TXT or CNAME given under <selector>._domainkey.yourdomain. Prefer a 2,048-bit key, split into 255-character strings if your zone editor requires it.
Google asks to wait 48 hours after SPF and DKIM. Then publish under _dmarc.yourdomain: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain, to a dedicated mailbox (Microsoft advises a shared mailbox, not yours). This policy stops nothing: it sends you the reports.
Run this tool again, send an email to a Gmail mailbox and open “Show original”: SPF, DKIM and DMARC must show PASS. Read the reports for several weeks (OVH advises it), move to p=quarantine with pct=10 then 100, and finally to p=reject when no legitimate sending fails any more.
Frequently asked questions
Yes. The 5,000-messages-a-day threshold only exists at Google and Microsoft, and only concerns their mailboxes. Orange now requires SPF, DKIM and DMARC from every sender (rules updated on 1 September 2026), laposte.net since September 2025, iCloud with no threshold. And even at Gmail, an email without SPF or DKIM can be refused with error 5.7.26 from the first sending. A tradesperson writing to customers at @orange.fr is concerned from the first quote.
To be accepted, often yes: Gmail and Outlook.com accept p=none for bulk senders, and Orange asks for a DMARC record without specifying the policy. But p=none stops nothing: a spoofed email passes like yours. It is the starting point, with a rua= address to receive the reports. After a few weeks without failures on your legitimate sending, move to p=quarantine (pct=10 first), then to p=reject.
Because SPF alone is no longer enough: Orange, laposte.net and iCloud also want DKIM and DMARC. And the SPF record set by the host only covers its mailbox: the quoting software, the newsletter or the website form that send in your name are not in it, and their emails fail. Finally, authentication is only part of the filtering: IP reputation, content and complaints count too.
Not necessarily. The tool probes the selectors documented by your provider and about twenty common selectors. OVH (ovhmo<id>-selector1), Amazon SES (random selectors) and Zoho (selector chosen by you) cannot be guessed. To check: send yourself an email, open the full header, look for the DKIM-Signature line; the s= value is your selector, and d= the signing domain. If that line does not exist, the service has not enabled DKIM.
This check first: a broken SPF record, a revoked DKIM key or a malformed DMARC record explain a sudden change. Then send an email to a Gmail mailbox and open “Show original”: the SPF, DKIM and DMARC lines say which one fails. If everything passes, look at the content (shortened link, unusual attachment, new sending software) and register the domain in Google Postmaster Tools to read its reputation. Since November 2025, Gmail progressively rejects non-compliant messages.
mail-tester scores one precise sending, from the tool you used to write to it. It says nothing about the other services that send in your name, nor about the history of your domain at each mailbox provider, nor about how recipients react. A 10/10 with your mailbox does not vouch for the invoicing software. This tool, for its part, reads the configuration of the domain for every service listed in your SPF record. The two complement each other.
The name under which the public key is published in your DNS: <selector>._domainkey.yourdomain. It lets a domain have several keys, one per sending service, and rotate them. Google uses google, Microsoft selector1 and selector2, o2switch and LWS default, Gandi gm1 to gm3, Mailjet mailjet, Brevo brevo1 and brevo2. Every signed email names its selector in the DKIM-Signature header (s=).
The diagnosis is free: this tool, then my reading within 24 hours if you send me your domain. The set-up is quoted according to your host, the number of services that send in your name and the state of the existing SPF record: usually a few hours of work, then one or two appointments several weeks apart to move DMARC to quarantine then reject after reading the reports.
Blog
The PHP vulnerability of October 2026, the checks for a hacked WordPress site, and what e-invoicing changes for a tradesperson in France: three reads for the same small businesses.
Two critical vulnerabilities in PHP were patched on October 21, 2026. Are your WordPress sites, PrestaShop or WooCommerce stores, custom applications, or internal networks at risk? Learn who is impacted, what your hosting provider is doing, and what actions you should take today.
Since October 18, 2026, stolen UpdraftCentral keys have been used to install fake plugins and hidden accounts on WordPress sites—even those kept up to date. Here are the seven checks to perform today, in the exact order I follow them on a client’s site.
From September 2026, you must be able to receive electronic invoices; in 2027, you will need to issue them. What’s changing for a tradesperson and how to prepare for it.
Send me your domain name and your host. I set up SPF, DKIM and DMARC in your DNS zone, check by sending test emails and write down what was done. Free diagnosis within 24 hours, quote before any work.