What these three records do
Someone can send email that looks like it's from your domain — an invoice, a password reset, a request to change bank details — without ever touching your mailbox. Whether that email gets delivered depends on three DNS records you publish: SPF, DKIM and DMARC. Receiving mail servers read them to decide whether a message claiming to be from you is real.
SPF
SPF is a list of the servers allowed to send email for your domain. It ends with an "all" rule that says what to do with everyone else: -all (fail) or ~all (soft fail) give real protection; ?all (neutral) and +all (allow anyone) give none. We read your SPF record and that final rule.
DKIM
DKIM adds a cryptographic signature to each message you send. The receiving server checks it against a public key in your DNS, published under a name called a selector. A valid signature shows the message wasn't forged or altered on the way.
DMARC
DMARC tells receiving servers what to do when a message fails SPF and DKIM, and where to send reports about it. The policy is the p= tag:
- p=none — monitor only. Forged email is still delivered as normal.
- p=quarantine — failing email goes to spam or junk.
- p=reject — failing email is refused outright.
We also read pct=, which applies the policy to only part of your mail when it is below 100.
If a record is missing
Ask whoever runs your email (Google Workspace, Microsoft 365 or your hosting provider) for the exact SPF entry and DKIM setup for your account; each provider has its own. Add SPF first, then turn on DKIM in your email provider's settings. Then publish DMARC at p=none with a reporting address, read the reports for a few weeks to confirm your real mail passes, and move to p=quarantine and then p=reject. Jumping straight to reject can block legitimate mail from a service you forgot was sending for you.
What our DKIM check can and can't see
DKIM keys can't be listed from outside: you have to know the selector name to look one up. We try 14 common selector names, including the ones Google Workspace, Microsoft 365, SendGrid and Resend use. If we find a key, we flag it when it is 1024-bit (2048-bit is recommended) or when it has been revoked (an empty key).
If your provider uses a different selector, we can't see it, and we'll report DKIM as "not detected", not "missing". We also don't read your actual email, so we can't confirm that your messages are being signed. To check that, open a message you sent in Gmail, choose "Show original", and look for DKIM: PASS.