Check a domain
How it works
Provider is detected
MX records reveal whether the domain is on Google or Microsoft. Override it if you are checking a domain mid-migration.
Each record is compared
Expected value on the left, what DNS actually returns on the right, with a verdict per row.
Extras are flagged
Leftover MX hosts from the previous provider, a second SPF record, an old verification string — the things that quietly break routing.
Fix and re-run
Changes propagate within the TTL. Re-check once the propagation checker shows the new value everywhere.
What each provider expects
Google Workspace now uses a single MX host, smtp.google.com at priority 1; the older five-host aspmx.l.google.com set still works and is still what many setup guides show. SPF is include:_spf.google.com. DKIM is a TXT record at google._domainkey that only exists once you generate and start authentication in the Admin console — the step most often skipped. Verification is a google-site-verification= TXT that can be removed after setup but is harmless to leave.
Microsoft 365 uses one MX host derived from your domain, yourdomain-com.mail.protection.outlook.com. SPF is include:spf.protection.outlook.com. DKIM is two CNAME records, selector1._domainkey and selector2._domainkey, pointing at hosts under your tenant's onmicrosoft.com domain — and again, signing has to be switched on in the Defender portal after the records exist. autodiscover is a CNAME to autodiscover.outlook.com so Outlook clients configure themselves.
Why setups fail after they “worked”
Mail flows the moment MX is right, so people stop there. DKIM and DMARC never get finished, and the domain sends for months with SPF only. That is enough for Gmail's basic checks until volume crosses the bulk threshold, at which point DKIM becomes mandatory and delivery collapses overnight with no change on your side. Run this check on every domain when it is set up, and again before it goes into a sending rotation.
The other common failure is the migration leftover. A domain moved from Microsoft to Google keeps its old MX at a lower priority “just in case”, or keeps both SPF includes. Two SPF records is a permanent error. A stale MX means some mail still routes to the old tenant after it is decommissioned. The checker flags any host it does not expect for the detected provider.
DMARC is not part of either setup wizard
Neither provider creates a DMARC record for you. The check shows it as a review item rather than a failure because mail works without it, but both Google and Yahoo now require it from bulk senders and it is the record that makes DKIM alignment mean anything. Start with p=none and a reporting address, watch the reports for two weeks, then move to quarantine. The DMARC generator builds the record.
Frequently asked questions
Which MX records should Google Workspace have?
Either the single record smtp.google.com at priority 1, or the five aspmx.l.google.com hosts at priorities 1, 5, 5, 10, 10. Both are valid; Google recommends the single record for new setups. Remove anything else.
My DKIM check fails on Google Workspace. Why?
The record only exists after you go to Admin console → Apps → Google Workspace → Gmail → Authenticate email, generate a key, publish the TXT record it gives you, and then click Start authentication. Missing the last click is the usual cause.
Why does Microsoft 365 use CNAME for DKIM instead of TXT?
So Microsoft can rotate the keys without you touching DNS. The CNAME points at a host in their zone where the actual key lives; two selectors let them rotate one while the other stays active.
Do I still need the verification TXT record?
Not after the domain is verified, but leaving it does no harm and some Google services re-check it. Remove only if you are tidying the zone deliberately.
What if the domain is on both providers?
Split delivery is possible but fragile, and two SPF includes in one record is fine while two SPF records is not. The checker assumes one primary provider; choose it from the dropdown and treat the other's records as extras to review.
The MX is right but mail is not arriving.
Check the propagation checker to confirm the record is visible from multiple resolvers, then the NS checker to confirm you edited the DNS that is actually authoritative. Split DNS — records edited in a panel that is not the live one — is the most common cause.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.