If your domain's email records are missing or wrong, anyone can send email that appears to come from you, and your own messages are more likely to land in junk folders. Three DNS records control this: SPF, DKIM and DMARC. Checking them takes about 15 minutes, and you do not need to be technical to do it.
What each record does
SPF (Sender Policy Framework) is a list of the servers allowed to send email for your domain. A receiving server compares the server that delivered a message with that list.
DKIM (DomainKeys Identified Mail) adds a digital signature to every message. The receiver checks the signature against a public key published in your DNS, which shows the message came from your email platform and was not changed on the way.
DMARC ties the two together. It tells receivers what to do with a message that claims to be from your domain but fails the checks: deliver it anyway, send it to junk, or reject it. It also asks receivers to send you reports, so you can see who is sending email in your name.
Why it matters
Since 2024 the large mailbox providers have required bulk senders to have all three in place, and they treat mail from domains without them with more suspicion. More importantly, a domain with no DMARC policy is easy to impersonate in an invoice fraud or phishing email aimed at your own customers and suppliers.
The 15-minute check
- Send a test message. From your normal mailbox, send an email to
check-auth@verifier.port25.com. Within a couple of minutes you get a reply with a summary at the top showing a pass or fail for SPF and DKIM. - Look up your DMARC record. Use any online DNS lookup tool to find the TXT record at
_dmarc.yourdomain.co.uk. If nothing comes back, you have no DMARC policy. - Count your SPF records. Look up the TXT records on the domain itself. There should be exactly one that starts with
v=spf1. Two is a common mistake, and it breaks SPF for both.
Quick win: if the test reply shows DKIM as none or fail, DKIM signing is probably switched off. In Microsoft 365 and Google Workspace it is a setting you have to turn on yourself, after publishing two DNS records the platform gives you.
What good looks like
- One SPF record, listing only the services that really send email for you, and ending in
-allor~all. - DKIM signing switched on, with the DNS records your email platform gives you published exactly as shown.
- A DMARC record with a policy of
quarantineorreject, and reports going to a mailbox or service that someone actually reads.
example.co.uk. TXT "v=spf1 include:spf.protection.outlook.com -all"
selector1._domainkey CNAME selector1-example-co-uk._domainkey...
_dmarc.example.co.uk. TXT "v=DMARC1; p=reject; rua=mailto:reports@example.co.uk"If you are starting from nothing, begin with p=none so you only collect reports. Check that every legitimate sender passes, including your email platform, your accounts software and any marketing tool, then move to quarantine and finally to reject.
Common problems we find
- Two SPF records, left behind when a new service was added alongside an old one.
- DKIM never switched on after a move to Microsoft 365 or Google Workspace. Mail still flows, so nobody notices.
- DMARC reports going to an old provider's mailbox, often the registrar or whoever first set up the domain, so nobody ever reads them.
- A strict DMARC policy with no DKIM, which means legitimate mail that gets forwarded can be rejected.
Each of these takes minutes to fix once you know it is there. If you would like us to check your domain and tell you exactly what to change, get in touch.
