SPF, DKIM and DMARC checker

What each record does

SPF

A TXT record on your domain that lists the servers allowed to send mail for it. It starts with v=spf1, and a domain must have exactly one. End it with ~all or -all, and keep it under 10 DNS lookups.

DKIM

A key your email provider uses to sign each message, published as a TXT record under a selector, such as google._domainkey for Google Workspace or selector1._domainkey for Microsoft 365. Receivers use it to check the mail wasn't changed and really came from you.

DMARC

A TXT record at _dmarc.yourdomain that tells receivers what to do when SPF or DKIM fails, and where to send reports. Gmail, Yahoo and Microsoft expect one from domains that send a lot of mail.

MX

The servers that receive mail for your domain. Without them, replies to your cold emails bounce.

Common fixes

• Google Workspace

  SPF: v=spf1 include:_spf.google.com ~all. Turn on DKIM in the Admin console under Apps, Google Workspace, Gmail, Authenticate email, then publish the key it gives you.

• Microsoft 365

  SPF: v=spf1 include:spf.protection.outlook.com -all. Turn on DKIM in the Microsoft Defender portal under Email authentication settings, then publish the two CNAME records it shows.

• DMARC to start with

  v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Once the reports show your mail passing, move to p=quarantine.

• Two SPF records

  Merge them into one: keep a single v=spf1, put every include in it, and end with one ~all or -all.

Questions

Do I need SPF, DKIM and DMARC for cold email?

Yes. Gmail, Yahoo and Microsoft check them on every message, and mail from a domain without them is far more likely to land in spam or be refused. Set up all three before you send your first campaign.

What is the difference between ~all and -all in SPF?

~all (soft fail) asks receivers to accept mail from other servers but treat it with suspicion. -all (hard fail) asks them to refuse it. Both are fine for sending; +all and ?all are not.

Why does the checker find no DKIM key?

DKIM keys live under a selector chosen by your email provider. The checker tries the common ones. If yours uses a different name, check your provider's DKIM settings; if signing is off there, turn it on and publish the key.

How long do DNS changes take?

Usually minutes to a few hours, and up to 48 hours in some cases. Check again after you change a record.

Should I send cold email from my main domain?

Many teams send from a second domain, such as getacme.com, so a spam complaint can't hurt the mail their main domain sends. Set SPF, DKIM and DMARC on that domain too, and give new mailboxes a few weeks to build up volume.