Three DNS records tell receiving servers that your mail is genuine. SPF lists which servers may send for you, DKIM adds a signature to each message, and DMARC says what to do when the first two fail. Big mailbox providers expect all three from anyone sending in volume.
When to run it
- Your messages land in spam or are refused and you suspect authentication.
- You added a new sending service and want to be sure the records cover it.
- You are preparing a new domain and want a quick audit before the first campaign.
What good looks like
- Exactly one SPF record, ending in ~all or -all, using fewer than ten DNS lookups.
- A DMARC record: start with p=none and a report address, then tighten it to quarantine or reject.
- A DKIM key at the selector your sending service gave you.
- Items shown in red are the ones to fix first.
Frequently asked questions
Do I need all three?
For bulk email, yes. SPF and DKIM prove who sent the message; DMARC connects them to the address in your From line.
Where do I find my DKIM selector?
In your sending service's settings, or in the "s=" tag of the DKIM-Signature header of a message you sent.
Will changing these records stop my mail?
Adding records is safe. Changing an existing SPF record needs care: make sure every service that sends for you stays listed.