What SPF, DKIM and DMARC each do
SPF publishes which hosts may send mail for a domain. DKIM adds a cryptographic signature using a selector record. DMARC tells receiving systems how to evaluate alignment between the visible From domain and authenticated domains, and what to do when a message fails.
Check SPF correctly
Query the TXT record at the exact envelope or return-path domain. Confirm there is one effective SPF record, the mechanism includes every authorized sender and DNS lookup limits are respected. Avoid copying several SPF records together; receivers may treat multiple records as a permanent error.
Check DKIM with the selector
The selector is chosen by the sending provider and appears in the DKIM-Signature header. Query selector._domainkey.example.com and confirm the public key is present. A correct record at the wrong selector, a missing key or a changed signing domain will cause DKIM verification to fail.
Understand DMARC alignment
DMARC is published at _dmarc.example.com. Its policy applies when SPF or DKIM authentication aligns with the visible From domain. A message can pass SPF but fail DMARC if the envelope domain is different, and forwarding can break SPF while DKIM may still survive.
Read reports and change policy carefully
Start with p=none to collect aggregate reports when setting up a new domain, then fix legitimate senders before considering quarantine or reject. Review rua report destinations, subdomain policy and alignment mode. Do not use a strict policy until all legitimate platforms are identified.
Investigate spam placement beyond DNS
Passing SPF, DKIM and DMARC does not guarantee inbox placement. Also check From and Reply-To behavior, reverse DNS, MX readiness, sending volume, bounce rate, complaint rate, content, links and the reputation of the sending IP or domain.
A practical troubleshooting sequence
Send a test message from every legitimate provider, inspect the Authentication-Results header, query SPF, DKIM and DMARC with DNS Lookup, compare the visible From and envelope domains, review provider reports and correct one sender at a time.
Common mistakes
Do not publish multiple SPF TXT records, forget a new mail provider, use the wrong DKIM selector, assume DMARC replaces SPF or DKIM, or set p=reject before testing forwarding and third-party senders.
Check real data now
Use the live IIPP tool to inspect the domain or IP address you are working with.
DNS Record Lookup →