Ctrl K

How to check SPF, DKIM and DMARC for a domain, and fix the common faults

Updated on 5 October 2026

The short answer. All three are DNS TXT records. SPF lives at the domain itself and starts v=spf1; DMARC lives at _dmarc. plus the domain and starts v=DMARC1; DKIM lives at a selector such as google._domainkey plus the domain. A checker reads each record, counts SPF's DNS lookups (the limit is 10) and shows the DMARC policy.

When mail from your domain lands in spam, or a client says your invoices never arrived, these three records are the first thing to check. They are how a receiving server such as Gmail or Outlook decides whether a message really came from you. A missing or broken record does not stop you sending, but it gives receivers a reason to distrust what you send.

What each record proves

Record Where it lives What it proves Fails when
SPF TXT at example.com the sending server's IP address is one the domain allows mail goes out through a service not listed in the record
DKIM TXT at selector._domainkey.example.com the message was signed by the domain and not changed on the way the provider is not signing, or a forwarder altered the message
DMARC TXT at _dmarc.example.com the domain in the visible From address matches a domain that passed SPF or DKIM, and says what to do if not neither SPF nor DKIM passes for the From domain

SPF and DKIM each check a domain, but not necessarily the one the reader sees. DMARC ties them to the From address, called alignment, and adds a policy: p=none (only report), p=quarantine (send to spam) or p=reject (refuse).

How to check a domain

  1. Open the Domain Health Check and type the domain, such as example.com, or paste an email address. It reads MX, SPF, DMARC and nine common DKIM selector names in one report.
  2. For detail on SPF, open the SPF Checker. It follows every include: and counts the DNS lookups across the whole tree.
  3. For DMARC, open the DMARC Checker. It explains each tag in sentences and, for a subdomain without its own record, walks up to the organisational domain.
  4. For DKIM you need the selector, which your email provider chooses. Google Workspace uses google by default and Microsoft 365 uses selector1 and selector2. Find it in an email you sent: in the DKIM-Signature header, s= is the selector and d= is the domain. Look it up in the DKIM Checker.
  5. Send a test message to a Gmail account, open it, choose Show original, and read the SPF, DKIM and DMARC results Gmail recorded. That is the final word on whether your mail passes.

A worked example

A small business sends from Google Workspace and a newsletter service. Its records:

example.com          TXT  "v=spf1 include:_spf.google.com include:servers.mcsv.net ~all"
_dmarc.example.com   TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
google._domainkey.example.com  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
  • SPF allows Google and the newsletter service, and ~all asks receivers to treat anything else as suspicious. Each include costs one lookup, plus whatever the included records contain; the checker shows the total, here well under 10.
  • DMARC is at p=none: receivers report failures to dmarc@example.com but deliver the mail. That is the right first step, not the last.
  • DKIM has a public key at the google selector, so Workspace mail is signed. If the newsletter service signs with its own domain rather than example.com, its mail passes SPF but may not align; most services offer a setting to sign with your domain.

The five most common faults

  1. Two SPF records. A domain may have only one TXT record starting v=spf1. Two is a permanent error and SPF fails for everyone. Merge them into one.
  2. More than 10 DNS lookups. SPF allows at most 10 terms that need a DNS query (include, a, mx, ptr, exists, redirect), counted across every nested include. Over 10 is a permanent error. Remove services you no longer use, or replace an include with the ip4: ranges it stands for.
  3. +all or no all at all. +all lets anyone in the world send as your domain. End the record with ~all or -all.
  4. No DMARC record. Without one, receivers apply their own judgement and you get no reports. Gmail requires one from bulk senders.
  5. DKIM never switched on. Many providers publish nothing until you click "start authentication" in their admin console, then add the TXT record they give you.

What Gmail requires

Google's sender guidelines, in force since February 2024, require every sender to Gmail personal accounts to have SPF or DKIM, valid forward and reverse DNS, TLS, and a spam rate below 0.3%. Senders of more than 5,000 messages a day to Gmail accounts must also have SPF and DKIM and a DMARC record (p=none is enough), with the From domain aligned to SPF or DKIM, and one-click unsubscribe on marketing mail.

Moving DMARC from none to reject

  1. Publish p=none with a rua= address and collect reports for two to four weeks.
  2. Read the reports (a DMARC reporting service turns the XML into tables). List every service that sends as your domain and fix SPF and DKIM for each one.
  3. Move to p=quarantine. Older records used pct= to apply the policy to only part of the mail; RFC 9989, published in May 2026, removed pct, and newer receivers ignore it. To soften a step, use t=y (test mode), which asks receivers to apply one level less than the stated policy.
  4. When reports show only genuine mail passing, move to p=reject.

If it doesn't work

  • The checker finds no SPF record you know you added. DNS changes can take up to the record's TTL to spread, often an hour, sometimes longer. Check the record is TXT, at the root (@), and not wrapped in extra quotes by your DNS panel.
  • SPF passes but DMARC fails. The envelope sender (Return-Path) belongs to your email service, not your domain, so SPF is not aligned. Turn on DKIM signing with your own domain at that service.
  • DKIM fails only for forwarded mail or mailing lists. They change the message, which breaks the signature. ARC headers from big providers help; there is little to fix on your side.
  • DMARC reports never arrive. If rua= points at another domain, that domain must publish a TXT record at example.com._report._dmarc.otherdomain.com granting permission.
  • The DKIM checker says "no record". The selector is wrong. Read s= from a sent message's DKIM-Signature header.

Questions people ask

How do I check the SPF record of a domain?

Look up the domain's TXT records and find the one that begins with v=spf1. An SPF checker does this, follows each include: to the records it points at, and counts the DNS lookups across all of them, which must not exceed 10. On a computer, nslookup -type=txt example.com prints the raw TXT records as well.

What is a DMARC record and do I need one?

A DMARC record is a TXT record at _dmarc followed by your domain, such as v=DMARC1; p=none; rua=mailto:reports@example.com. It tells receivers what to do with mail that fails SPF and DKIM alignment and where to send reports. Gmail requires one from anyone sending more than 5,000 messages a day to its users, and every domain benefits from having one.

What does the SPF 10 lookup limit mean?

RFC 7208 allows at most 10 SPF terms that need a DNS query during one check: include, a, mx, ptr, exists and redirect, counted across every nested include. A record that needs more is a permanent error, so SPF fails for every message. Terms ip4, ip6 and all cost nothing, so replacing unused includes with IP ranges brings the count down.

Should my SPF record end in ~all or -all?

Either is acceptable once every sending service is listed. ~all (softfail) asks receivers to treat unlisted servers as suspicious, -all (fail) asks them to reject. With DMARC in place, receivers act mainly on the DMARC policy, so ~all is the common choice; -all suits domains that send no mail at all. Never use +all.

Why do my emails go to spam even with SPF and DKIM?

Authentication proves who sent a message, not that recipients want it. Gmail and Outlook also weigh spam complaints, the sending IP's reputation, missing reverse DNS, a missing DMARC record, links to flagged sites and sudden jumps in volume. Check DMARC alignment first, then the spam rate in Google Postmaster Tools, and make sure marketing mail has a one-click unsubscribe.

Sources

Checked 5 Oct 2026:

The tools for this