ColdLint
SPF, DKIM, and DMARC checker
Enter the domain that will send the campaign. ColdLint reads the live DNS records and says, in plain language, what a receiver will not be able to verify.
The verdict shows up here.
Scores run from rules on the server, so the same paste always lands in the same place. Nothing is sent to a model unless you later press Rewrite, and that button stays hidden until a key is configured.
- AI-slop, with a concrete edit for each flagged line
- Spam triggers, links, caps, and broken merge tags
- SPF, DKIM, DMARC, and MX in plain language
What each record does
SPF is a TXT record on the root domain that starts with v=spf1. It lists the servers allowed to send mail for that domain. You only get one SPF record. If Instantly and Google Workspace both send, both have to be on that single record. Two SPF records is invalid, and this check says so.
DKIM signs each message so the inbox can tell it was not altered. The public key lives at a selector, for example google._domainkey or selector1._domainkey. This check tries common selectors and follows CNAMEs. A custom selector will not appear. The result says that, instead of claiming DKIM is missing.
DMARC is the TXT record on _dmarc. It tells receivers what to do when SPF or DKIM fails alignment. p=none only collects reports. p=quarantine and p=reject actually enforce. A missing record is called out. Monitor-only mode is described as a reasonable first setting, not as a failure.
MX records are where replies go. A domain with no MX can still sometimes send, but replies have nowhere to land, and some receivers treat that as a sign the domain is not ready.
One lookup versus a record over time
This page is a one-off lookup and it counts toward the free daily limit. Pro saves the domain on your account. Each check is stored, and a daily job rechecks it when the host cron is configured. The account page shows what changed: SPF text, DMARC policy, DKIM selectors, or MX hosts.
DNS lookups can time out. A failed lookup is labeled as a lookup error, not as a missing record. Run it again before you change anything at the DNS host.
Pair the domain result with a copy check. Authentication will not save a sequence that reads like a template. ColdLint scores both.