Domain Authentication Status Checklist

This guide shows you how to quickly check if your domain has the required SPF, DKIM, and DMARC records set up. Click here for the w3Nerds Guide to Mass Email Deliverability. 

1. Using a Free Online Checker

The easiest way to check is using a free, third-party DMARC analysis tool. These tools typically check all three records at once.

• Recommended Tool: You can use popular checkers like MXToolbox (DMARC Check), dmarcian (Domain Checker), or similar online DNS lookup tools.
• Action:
  1. Go to the checker website (e.g., Google "DMARC checker").
  2. Enter your company's domain name (e.g., yourcompany.com).
  3. Click "Check" or "Search."

 

---

2. Reviewing the Results

The tool will return a status for each record. Here's what you're looking for:

SPF Status Check

SPF Check results, what they mean, and what action needs to be taken. 

• "Valid" or "Found"
  • This means an SPF record is published.
  • Verify the included senders: Ensure it lists all services that send email for you (e.g., Google Workspace, Microsoft 365, your CRM, your mass email software). If not, update it.
• "No SPF record found"
  • This means no record is published.
  • CRITICAL: You must create and publish an SPF record immediately.
• "Multiple SPF records found"
  • This means the tool found more than one record (e.g., two different TXT entries).
  • CRITICAL: This is invalid and will cause failure. You must merge all authorized senders into one single SPF record.

DKIM Status Check

DKIM is slightly different as you need to know the specific "selector" key used by your email service provider. However, the online checker will usually look for common selectors.

• "Valid" or "Found"
  • This means a DKIM record is published and can be verified.
  • No further action is required. 
• "No DKIM record found"
  • This means no record is published.
  • CRITICAL: You must generate DKIM keys from your email service provider (e.g., Google, Microsoft, or your email software) and publish the corresponding CNAME or TXT record in your DNS.

DMARC Status Check

The DMARC record is essential for policy and reporting.

• "Record Found"
  • This means a DMARC record is published.
  • Verify the Policy (p=): The goal is to move from p=none (monitoring only) to p=quarantine or p=reject (active enforcement).
• "No DMARC record found"
  • This means no record is published.
  • CRITICAL: Publish a DMARC record immediately. Start with a monitoring policy (p=none) and an email address for reports (rua=).

3. Next Steps After Verification

1. If all records are found and valid: You meet the technical minimums! Focus on content quality and list hygiene (Sections 2 and 3 of the original article).
2. If any records are missing, invalid, or multiple: STOP mass emailing until they are fixed. Work with your IT team, domain registrar (where you bought the domain), or hosting provider to publish/correct the required TXT records in your DNS settings.

 

---