``If your emails land in spam or get rejected, the cause is often a missing or broken DNS record. SPF, DKIM, and DMARC are three TXT record types that tell receiving servers which senders are allowed to send mail for your domain, and whether those messages can be trusted. You can check all three from a terminal in under a minute, without logging in to any dashboard.
What each record does
- SPF lists the servers allowed to send mail for your domain.
- DKIM publishes a public key that verifies a message’s cryptographic signature. Each key is stored under a selector, such as default or google.
- DMARC tells receivers what to do when SPF or DKIM fails, and where to send aggregate reports.
Check SPF
SPF lives in a TXT record on the root domain. Replace example.com with your domain:
bash
dig TXT example.com +short
Look for a line starting with v=spf1. A valid record might look like this:
"v=spf1 include:_spf.example-mailer.com -all"
Common problems to look for:
- Two SPF records. Receivers treat a domain with multiple v=spf1 records as an error. Merge them into one.
- Too many lookups. SPF allows 10 DNS lookups. Heavy use of include: can exceed that limit.
- No record at all. Mail from services you use may fail without an error you can see.
Check DKIM
DKIM keys are stored under a selector, so you need the selector name your mail provider uses. Replace default with yours:
bash
dig TXT default._domainkey.example.com +short
You should see a long string beginning with v=DKIM1 and containing a p= public key. If the command returns nothing, either the selector is wrong or the key was never published.
Check DMARC
DMARC lives at the _dmarc subdomain:
bash
dig TXT _dmarc.example.com +short
A starter policy looks like this:
"v=DMARC1; p=none; rua=mailto:reports@example.com"
Start with p=none so you can read the reports without blocking legitimate mail. Once SPF and DKIM pass for all your real senders, you can move to p=quarantine and then p=reject.
A quick checklist
- Confirm one SPF record exists and covers every service that sends mail for your domain.
- Confirm the DKIM selector returns a public key.
- Publish a DMARC record with p=none and a reporting address.
- Send a test message to an address you control, and check the headers for spf=pass, dkim=pass, and dmarc=pass.
- Review the DMARC reports for a few weeks before tightening the policy.
Wrapping up
Command-line checks are fast, repeatable, and easy to script. Run them after any DNS change, and you’ll catch most configuration mistakes before your recipients do.
Disclosure: I work with HostBible, a web hosting company. If you want to see DNS and email tools in a hosting control panel, you can browse their site: https://hostbible.com/
Top comments (0)