How to Check SPF, DKIM, and DMARC
SPF, DKIM, and DMARC are three email authentication standards that work together to protect a domain from spoofing and phishing. Each one is published as a DNS record and serves a different role. This guide shows you where to find each record and what to look for.
Checking SPF
SPF is a TXT record at the domain root. Query example.com for TXT records and look for the one starting with v=spf1. It lists which IPs and services are authorized to send mail for the domain.
Key things to check: Does the record end with -all or ~all? Are all your sending services included? Does the record stay under the 10-lookup limit?
Checking DKIM
DKIM records are TXT records at selector._domainkey.example.com. You need to know the selector name (common ones: google, selector1, s1, default). The record contains a public key used to verify message signatures.
Key things to check: Does the TXT record exist for the selector your mail service uses? Is the p= field populated (not empty)? Does the key type match what your server sends?
Checking DMARC
DMARC is a TXT record at _dmarc.example.com. It defines the policy receivers should apply when SPF and DKIM fail, and where to send aggregate reports.
Key things to check: What is the p= policy (none, quarantine, reject)? Is a rua= reporting address configured? Are alignment modes appropriate for your setup?
Common mistakes
- Publishing multiple SPF records (only one is allowed per domain)
- Using the wrong DKIM selector name when troubleshooting
- Jumping to
p=rejectbefore reviewing DMARC reports - Forgetting to include third-party senders in SPF
- Not monitoring aggregate reports after DMARC deployment