Why this matters for a launch
Launch day is when you email the most people from a domain that may be a few weeks old. If SPF, DKIM or DMARC are missing, mailbox providers have no way to tell your mail from someone spoofing you, and your announcement lands in spam. Each record takes minutes to add at your DNS provider.
The three records
- SPF is a TXT record on your domain listing the servers allowed to send as you, e.g.
v=spf1 include:_spf.google.com ~all. One record only, at most 10 DNS lookups, ending in~allor-all. - DKIM is a public key at
selector._domainkey.yourdomain. Your email provider signs each message with the matching private key. Use 2048-bit keys where your provider allows it. - DMARC is a TXT record at
_dmarc.yourdomainthat tells receivers what to do when a message fails both SPF and DKIM alignment (p=none,quarantineorreject) and where to send reports (rua=).
How we check
We look up MX, SPF, DMARC and eight common DKIM selectors through Cloudflare’s DNS-over-HTTPS resolver, then expand every SPF include to count lookups the way receivers do. If a subdomain has no DMARC record, we check the parent domain’s, which receivers fall back to. Each finding comes with a verdict and the fix.
What we can’t check from DNS alone: whether your messages actually pass. For that, send a test email to a Gmail account, open it, choose “Show original” and look for SPF, DKIM and DMARC: PASS. To see any record raw, use the DNS lookup.