How to check SPF, DKIM and DMARC

When SPF, DKIM or DMARC are missing or wrong, order confirmations and password resets land in spam or don’t arrive, and others may be able to send mail as you. A Domain & email monitor checks the domain’s email setup twice a day, from DNS.

Turn it on

1. Open Monitors, choose New monitor and pick Domain & email.
2. Enter the Domain and keep Check email authentication on.
3. If you sign mail with a DKIM selector we might not know, add it under Your DKIM selectors. It is the part before ._domainkey in the DKIM record’s name.
4. Tick the alert channels and choose Create monitor.

Already have a domain monitor? Edit it and turn on Check email authentication.

What is checked

• SPF lists the servers that may send as the domain: one record, ending in ~all or -all, with at most 10 DNS lookups.
• DKIM signs each message. We look for keys at your mail provider’s selectors and the usual ones.
• DMARC tells receivers what to do with mail that fails: p=none only watches, quarantine sends it to spam, reject refuses it. Gmail and Yahoo require it from bulk senders.
• MX, where the domain receives mail.

When something is wrong

Each problem says what to do, with a ready-made DNS record where one fixes it. You are alerted when a new problem appears, such as a second SPF record. More on email authentication monitoring.