How to Check SPF, DKIM and DMARC in 5 Minutes

If your emails are landing in Gmail or Outlook spam folders, the cause is almost always missing or broken email authentication — SPF, DKIM or DMARC. This guide shows in five minutes how to check all three for any domain and which typical mistakes you can fix immediately.

Quick answer

Open the DNS Lookup, enter the domain.
In the TXT records, look for entries starting with v=spf1, v=DKIM1 and v=DMARC1.
If one is missing: add it. If one is wrong: fix it (see sections below).

That's it. The rest of this article explains the three mechanisms, shows correct and broken examples, and names the most common mistakes.

What do SPF, DKIM and DMARC actually do?

Each mechanism solves a different problem in email security. More background in the glossary entries for SPF, DKIM and DMARC.

Standard	What it asserts
SPF	"These servers are allowed to send mail for my domain."
DKIM	"This email is signed by me and unchanged in transit."
DMARC	"Here's how you should handle mails that fail SPF or DKIM."

Gmail and Outlook evaluate all three before delivering to the inbox. Missing one drops the delivery rate. Missing several gets the mail tagged as spam directly.

Step 1 — check SPF

Enter your domain in the DNS Lookup and look under TXT records for an entry like:

v=spf1 include:_spf.google.com ~all

Read it left to right:

v=spf1 — SPF version 1.
include:_spf.google.com — all servers listed in Google's SPF record may send for this domain. With Microsoft 365 it's include:spf.protection.outlook.com instead.
~all — everything else: softfail (mark as suspicious, but don't reject outright).

Common SPF mistakes

Multiple SPF records on one domain — RFC 7208 allows only one. Multiple TXT records starting with v=spf1 cause PermError. Fix: merge into a single record.
Too many DNS lookups (more than 10) — SPF limits chained include: statements to 10. If you use SaaS services like Mailchimp, SendGrid, HubSpot and Google in parallel, you hit the limit fast. Fix: SPF flattening (write out the IPs manually instead of include).
-all too early — strict mode (-all) without a complete sender list will block your own mail. Start with ~all, only switch to -all once you're certain.

Step 2 — check DKIM

DKIM records sit under a selector. Find the selector in your outbound mail: inspect the headers (in Gmail: "Show original"), look for the line DKIM-Signature:. It contains s=selector_name.

Then in the DNS Lookup, enter the hostname selector_name._domainkey.yourdomain.com. Example:

google._domainkey.example.com   TXT   "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

Common DKIM mistakes

Selector unknown — many providers rotate selectors silently. Fix: inspect headers of a recent outbound mail.
Public key truncated — DKIM keys are often >255 characters and must be split into multiple substrings in the TXT record. Joined incorrectly = invalid. Tools like our DNS Lookup show the full reassembled value.
Wrong algorithm — k=rsa is standard. Some providers experiment with k=ed25519, which is not supported by all receivers yet.

Step 3 — check DMARC

DMARC sits under _dmarc.yourdomain.com. In the DNS Lookup, enter the hostname:

_dmarc.example.com   TXT   "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"

Understanding the fields:

v=DMARC1 — DMARC version.
p=quarantine — policy: on failure, move to spam (alternatives: none = only report, reject = refuse outright).
rua=mailto:dmarc@example.com — address that receives aggregate reports.
pct=100 — policy applies to 100 % of mail (during test phases often lower, e.g. pct=10).

Common DMARC mistakes

Starting directly with p=reject — kills every non-aligned mail immediately, including legitimate newsletters and SaaS mail. Recommended workflow: start with p=none plus rua, evaluate reports, then progress to quarantine, then reject.
No rua — DMARC without reporting is blind. You don't know who's sending in your name.
DMARC, but neither SPF nor DKIM aligned — DMARC relies on SPF + DKIM. Without at least one aligned, every mail fails.

Step 4 — check IP reputation

If SPF, DKIM and DMARC are clean but mail still lands in spam: check your mail-server IP reputation. Use Blacklist Check to scan against 30+ DNSBLs. If listed: full instructions in How to Remove Your IP from a Blacklist.

From the command line

# SPF
dig example.com TXT +short | grep spf1

# DKIM (you need the selector!)
dig google._domainkey.example.com TXT +short

# DMARC
dig _dmarc.example.com TXT +short

On Windows: nslookup -type=TXT example.com.

Example setup for a new domain

You run a server that sends mail via Postfix. Minimal setup for example.com:

; SPF (TXT record on example.com)
"v=spf1 mx ~all"

; DMARC (TXT record on _dmarc.example.com)
"v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

For DKIM you additionally need a signing setup on the mail server (OpenDKIM or similar) and publish the public key as a TXT record under your-selector._domainkey.example.com.

Frequently asked questions

How long until changes take effect? DNS cache refresh takes TTL seconds — typically 300 to 3600 (5 min to 1 h). Plus: some receiver mail servers additionally cache DKIM selectors for several hours.

Do I really need DKIM if I only send little mail? Yes. Since 2024, Gmail and Outlook expect all three for "bulk senders". But even at low volumes, DKIM significantly improves delivery.

What does dmarc=fail (sp=quarantine) mean in mail headers? The mail failed DMARC, and the subdomain policy is quarantine. Check the SPF and DKIM result headers to see exactly which check failed.

How many DMARC reports will I receive? With active rua= and low volume: 5-20 per day from the major providers (Gmail, Yahoo, Microsoft). At higher volumes: many more. Tools like Postmark DMARC Digests or self-hosted parsedmarc are worth the effort to parse them.

Related tools at a glance

DNS Lookup — TXT records for SPF, DKIM, DMARC
Blacklist Check — check mail-server IP against 30+ DNSBLs
Whois Lookup — domain owner, registrar, nameservers
How to Remove Your IP from a Blacklist — step-by-step delisting