Check the three DNS records that decide whether your email is trusted — and whether anyone else can send mail pretending to be you.
Three DNS records decide whether your email reaches an inbox or a spam folder, and whether somebody else can send mail that appears to come from your domain. SPF says which servers may send for you, DKIM signs each message so it can be proved genuine, and DMARC tells receivers what to do when the first two fail.
Enter a domain to check all three. The SPF check also counts DNS lookups, which is the failure almost nobody catches by reading the record.
SPF allows a maximum of ten DNS-querying mechanisms per record. Go over it and receivers return a permanent error, which in practice means your SPF record is ignored entirely — the same outcome as not having one.
The trap is that the count is recursive. Each include: costs one lookup, and then everything inside that include counts too. Adding a single new provider can push a record that worked for years over the edge, and nothing warns you: the record still looks perfectly valid, mail still sends, and a portion of it quietly starts failing authentication.
If you are near the limit, the fix is to flatten or consolidate. Remove providers you no longer use, and be wary of any service whose SPF include pulls in several of its own.
SPF is a list of servers permitted to send mail for your domain, published as a TXT record. It checks the envelope sender, which means it breaks when mail is forwarded — a forwarded message arrives from the forwarder's server, not yours.
DKIM adds a cryptographic signature to each message using a private key, with the matching public key published in your DNS. Because the signature travels with the message, it survives forwarding, which is precisely where SPF fails.
DMARC ties the two together. It tells receivers what to do when both fail, and — importantly — it requires the domain to align with the one people actually see in the From header, which neither SPF nor DKIM checks on its own.
A DMARC record with p=none asks receivers to report what they see and nothing else. Nothing is rejected, nothing is quarantined, and anyone can still send mail as your domain and have it delivered.
That is the right place to start, because the reports tell you which legitimate senders you would break by tightening the policy. It is the wrong place to stop, and a great many domains have been sitting at p=none for years thinking they are protected. The path is none to quarantine to reject, watching the reports at each step.
DKIM keys live at selector._domainkey.yourdomain.com, and there is no way to list the selectors a domain uses — you have to know the name. A checker can only try the common ones.
So "not found" means "not at any name we guessed", not "you have no DKIM". To find yours, open a message you sent, view its full headers, and look in the DKIM-Signature line for s=. That value is the selector; enter it above for a definite answer.
One SPF record, well inside the lookup limit, ending in ~all or -all. DKIM signing on every sending service you use, with 2048-bit keys. DMARC at quarantine or reject, with an rua address someone actually reads.
Get there gradually. Tightening DMARC before your legitimate senders all pass alignment is how companies discover they have stopped their own invoices from being delivered.
Receivers return a permanent error and generally treat the record as unusable, so you get the same result as publishing no SPF at all. Nothing alerts you, and the record still looks valid to the eye, which is why it goes unnoticed for so long.
No. The specification allows exactly one, and receivers are required to treat more than one as a permanent error rather than choosing between them. Two records is worse than one imperfect one. It usually happens when a second provider is added without merging into the existing record.
Practically, yes. SPF breaks on forwarded mail, DKIM survives it, and DMARC is what ties either result to the domain your recipients actually see in the From line. Major providers increasingly require all three from bulk senders.
Because selectors cannot be enumerated — a checker can only guess common names. Look at the DKIM-Signature header of a message you sent, find the s= value, and enter that selector for a definite answer.
Use ~all (softfail) while you are still finding senders you have missed, and move to -all (hard fail) once DMARC reports show everything legitimate is passing. Never use +all: it authorises the entire internet to send as your domain.