How to check SPF, DKIM and DMARC step by step
Each mechanism protects a different part of mail delivery. Learn how to validate them together and avoid common DNS mistakes.
SPF, DKIM and DMARC are not three versions of the same control. SPF authorises sending sources, DKIM signs a message and DMARC aligns the result with the domain visible to recipients while defining an enforcement policy.
A complete inventory must include every sender: company mail, newsletters, CRM, invoicing and transactional applications.
SPF: one domain, one record
SPF is published as a TXT record for the sender domain. It should cover all authorised infrastructure without creating multiple competing SPF records.
- Merge include mechanisms and IP addresses into one record.
- Stay below the ten-DNS-lookup evaluation limit.
- Choose ~all during rollout or -all only after the sender inventory is complete.
DKIM: the signature must verify
A DKIM public key lives at selector._domainkey.example.com. A DNS record alone is not proof: the sending platform must sign outgoing messages with that selector.
- Use a modern key length.
- Rotate selectors without interrupting delivery.
- Inspect Authentication-Results in a message that reached a real mailbox.
DMARC: observe before enforcement
DMARC is published under _dmarc.example.com. A safe rollout commonly starts with p=none and report analysis, then moves to quarantine and reject when every legitimate sender passes aligned SPF or DKIM.
Email authentication checklist
- One SPF record covers every sender.
- DKIM is both published and used in outgoing mail.
- DMARC has reporting addresses and an enforcement plan.
- MX, TLS and sending-IP reputation are checked separately.
Put it into practice
Run an email security audit
N3X checks SPF, DKIM, DMARC, MX and related controls in one report.
Run an email security auditFrequently asked questions
Is SPF alone enough?
No. Forwarding can break SPF and it does not independently protect the domain visible in From. DKIM and DMARC are required for a stronger control.
Does DMARC affect deliverability?
A correct policy helps receivers trust legitimate mail. An incorrect or rushed enforcement policy can also reject valid messages.
How often should DNS records be checked?
After every provider change and periodically thereafter. DNS records and the real sender inventory tend to drift over time.