How to Check SPF DKIM DMARC Records in 10 Minutes
Check SPF DKIM DMARC records in ten minutes with free tools, see the two breaks we found on real domains, and copy the fixed records.
Can't see where your emails go? Check your domain's three records in ten minutes, and you'll have your answer. Most owners can't see it. You send quotes, reminders and follow-ups from your own domain, a handful never get a reply, and there is no way to tell whether the customer ignored them or never received them. The answer sits in three short text records attached to your domain, and you can check SPF DKIM DMARC records yourself in about ten minutes with free tools.
By the end of this post you will know whether your domain is set up to be trusted by Gmail and Outlook, and what to change if it isn't. We'll cover where each record lives and how to look it up, the two breaks we found on two real business domains we checked on October 6, and what the corrected records look like. We finish with the one setting that finally shows you where your mail goes.
Why Do Emails From Your Domain Quietly Go Missing?
Emails from your domain go missing when the receiving inbox can't confirm you're allowed to send them. Gmail, Outlook and Yahoo check three DNS records (SPF, DKIM and DMARC) on incoming mail. If those records are missing, duplicated or pointing at the wrong services, your messages land in spam or get rejected, and nobody tells you.
Here's the problem: very few service businesses send from one place. Your everyday inbox runs on Google Workspace or Microsoft 365, your CRM sends follow-ups, your booking tool sends confirmations, your invoicing app sends bills, and a newsletter platform sends the monthly update. Every one of those sends "as" your domain, and every one has to be listed in your records.
The inbox providers have also stopped being forgiving about it. Google's email sender guidelines require anyone sending to Gmail accounts to set up SPF or DKIM, and anyone sending 5,000 or more messages a day to Gmail addresses to publish DMARC too. We looked at what sending email actually costs in why email platforms charge you per contact. This is the other half of that story: whether the email you paid for arrives at all.
How to Check SPF DKIM DMARC Records With Free Tools
This is the exact routine we ran on October 6 against two domains, one belonging to a documentary film studio and one to an events company. Everything we used is public, so you don't need a login to your DNS host or your web developer on the phone. To check SPF DKIM DMARC records you only need your domain name and one email you have already sent.
Look up your SPF record and DMARC record first
Open a free DNS lookup tool. Google's Admin Toolbox has one called Dig, and MXToolbox works just as well. Type your bare domain (yourcompany.com), choose the TXT record type, and look for any line that starts with v=spf1. Count those lines. There should be exactly one.
Next, look up _dmarc.yourcompany.com, again as a TXT record. You are looking for a single line that starts with v=DMARC1. If the lookup comes back empty, you have no DMARC record, which was the case for one of the two domains we checked.
| Record | Where to look it up | What a healthy one looks like | What we found |
|---|---|---|---|
| SPF | yourcompany.com (TXT) | One line starting v=spf1 that lists every sender | Two lines on both domains |
| DKIM | selector._domainkey.yourcompany.com | A long public key for each sending service | Worth checking per service |
| DMARC | _dmarc.yourcompany.com (TXT) | One line starting v=DMARC1 with a rua report address | No report address on one, missing on the other |
Find your DKIM selector from an email you already sent
DKIM is the awkward one, because each service stores its key under a "selector" name you have to know first. The fastest way to find it is to open an email you sent to a Gmail address, click the three dots, and choose Show original. The DKIM-Signature header contains s= followed by the selector, and Google Workspace's default selector is simply google.
Better still, the top of that Show original screen tells you in plain words whether SPF, DKIM and DMARC passed or failed on that message. Quick Win: send one email from each tool that mails on your behalf (CRM, booking app, invoicing, newsletter) to a Gmail address you own, then open Show original on each. In ten minutes you have a pass or fail scorecard for every sender, without reading a single raw record.
The Lead Piranha Playbook
You're doing the work of a team you don't have.
Every Tuesday I show you one job I automated for good. What it does, the tools by name, and the prompt to copy.
No spam, unsubscribe anytime.
Both Domains We Checked Had Two SPF Records, and That Breaks Everything
The SPF standard allows one SPF record per domain. Under RFC 7208, the document that defines SPF, a domain publishing two of them produces a permanent error. In practice, the receiving server stops trusting either one, so your domain behaves as if it has no valid SPF record at all.
It happens innocently. Every tool's setup guide says "add this TXT record to your DNS," so whoever installs the tool adds a brand new SPF line instead of merging the new service into the existing one. Do that twice over a few years and you get exactly what we found.
The film studio: six senders, two records, reports going nowhere
The documentary film studio had six or more services sending as its domain, split across two SPF records. One of those records also included an address that doesn't exist, which is its own error even before the duplicate is counted. The studio did have a DMARC record, but with no report address, so every failure was happening silently.
The events company: Google doing the sending, missing from the list
The events company also had two SPF records, and one of them pointed at a host that no longer resolves. Neither record included Google, even though Google Workspace sends the company's everyday mail. So the busiest sender on the domain wasn't authorized anywhere, and there was no DMARC record to flag it.
Merge, never add
What Does a Fixed SPF Record and DMARC Record Look Like?
We wrote corrected records for both businesses. The specific services differ from domain to domain, so the version below uses placeholders, but the shape is identical. One SPF record, every real sender listed once, dead entries removed, and a soft fail at the end:
v=spf1 include:_spf.google.com include:your-crm-sender.example include:your-newsletter.example ~all
The DMARC record starts in monitoring mode, which means nothing gets blocked yet. It just asks every inbox provider to send you a report:
v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com
The order we made the changes in
Order matters, because changing DMARC before SPF is clean only fills your inbox with failure reports. We merged the SPF records into one and deleted the duplicate. We removed the include pointing at the dead address. We turned on DKIM inside each sending service's own settings (most have a "verify domain" or "authenticate" screen). Then we published DMARC with a report address. After each change, check SPF DKIM DMARC records again with the same lookup tool, so you catch a typo before it costs you a week of mail.
Records rarely break on their own. They break because a new CRM or booking tool gets connected and nobody owns the domain, which is a pattern we see every time a business does what we described in marketing automation inside the CRM you already use. As a Miami-based team building these systems end to end, we treat the domain as part of the build, and we lay out how that fits into the rest of the work in our full process overview.
Before
- Two SPF records cancelling each other out
- An include aimed at a dead host
- Google sending mail but never listed
- Failures reported to nobody
After Lead Piranha
- One merged SPF record
- Every sender listed once
- DKIM turned on per service
- DMARC reports landing weekly
Turn On DMARC Reports So You Can Finally See Your Mail
This is the step that answers the question you started with. Once your DMARC record has a rua address, Google, Microsoft, Yahoo and other providers start sending you aggregate DMARC reports, usually once a day. Each report lists every server that sent mail claiming to be your domain and whether it passed or failed.
The film studio already had DMARC, which is why the gap was so frustrating. The record existed, but without a report address the failures were going nowhere, so nobody could see that half the studio's tools weren't authorized. Adding one line of text turned that blind spot into a weekly report.
Bottom line: the raw reports are XML files that nobody wants to read by hand. Quick Win: point the rua address at a free DMARC report reader instead of your own inbox, and it will turn those files into a plain list of senders with pass rates. Give it two to four weeks, and you will see every service mailing as your domain, including the ones you forgot you connected.
After that window, with every legitimate sender passing, you can tighten the policy from p=none to p=quarantine, so anything failing goes to spam instead of the inbox. For businesses where one missed email is a lost job, the payoff is concrete. An events company with a contract stuck in spam loses the booking, which is the exact gap we dug into in where event companies lose bookings between enquiry and contract.
Quick Growth Check
5 questions. 30 seconds. Find out where your growth system stands.
Getting Every Quote, Reminder and Contract Into the Inbox
If your follow-ups go out from four or five tools, your email deliverability is only as good as the record nobody has looked at since the last tool was added. We set up the domain, the sending tools and the follow-up that runs on top of them as one system, so the quotes and reminders you write actually reach the people who asked for them. If you'd like us to look at yours, book a 30-minute call and we'll check SPF DKIM DMARC records on your domain first, using the same ten-minute routine from this post.
Next week we'll stay in the inbox and walk through what the first month of DMARC reports usually reveals, including the senders owners are most surprised to find.
