SPF, DKIM and DMARC check
Three DNS records decide whether mail claiming to be from a domain is believed. This reads all three, explains what each one is doing, and says which part is letting you down.
This reads public DNS only. No mail is sent, and nothing connects to the domain or its mail servers.
What the three records do
- SPF lists which servers may send mail for the domain. It is checked against the sending server address.
- DKIM publishes public keys. The sending server signs each message, and a receiver verifies the signature against the key in DNS.
- DMARC says what to do when SPF and DKIM fail, and where to send reports. Without it the other two are advisory.
The order to fix them in
- Publish SPF listing every service that sends as you, ending in ~all.
- Publish DKIM keys for each of those services.
- Publish DMARC with p=none and a rua address, and read the reports for a few weeks.
- Once the reports show only your own mail passing, move to p=quarantine and then p=reject.
Tightening DMARC before the reports are clean is how legitimate mail gets rejected. The reports exist precisely so that step is not a guess.
My mail goes to spam. Which of these is it?
Usually DMARC with p=none and a missing or soft SPF, which together tell receivers nothing enforceable. Fix SPF first, then DKIM, then tighten DMARC last — in that order, because DMARC acts on the other two.
Why can you not find my DKIM key?
DKIM keys live at a selector name that DNS provides no way to list. Without knowing yours, only common defaults can be tried. Your mail provider shows the selector in its DNS setup page; enter it above.
Is p=none bad?
It is the correct place to start and the wrong place to stop. It asks receivers to do nothing, so it protects nobody — but it does generate reports, which is how you learn what would break before tightening.
What is the 10-lookup limit?
Each include, a, mx, ptr, exists and redirect in an SPF record costs a DNS lookup, and the specification caps the total at ten. Past it, receivers must treat SPF as a permanent error, so it fails completely rather than degrading.
Does this send a test email?
No. It reads public DNS records and nothing else. No message is generated and no connection is made to the domain or its mail servers.