SPF, DKIM and DMARC: how to check what is wrong with your email setup (and fix it)

postwacht — Sun, 01 Nov 2026 18:51:15 +0000

Your emails land in spam, and you do not know why. Here is a short checklist to find out.

1. SPF: who may send for your domain

SPF is a DNS TXT record listing the servers allowed to send mail for your domain.

example.com.  TXT  "v=spf1 include:_spf.your-provider.com -all"

Common mistakes: more than 10 DNS lookups, two SPF records on one domain, or +all.

2. DKIM: proof the mail was not changed

Your sending service signs each mail. You publish the public key as a TXT record under selector._domainkey.example.com. Check that the selector in the mail header (DKIM-Signature: s=...) matches a record that exists and uses at least 1024, better 2048 bits.

3. DMARC: what receivers should do on failure

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Start with p=none, read the reports, then move to quarantine and reject.

4. The rest that gets forgotten

Reverse DNS (PTR) of your sending IP must match the hostname the server announces
The IP and the domain must not be on blocklists
TLS between servers should work
Gmail and Yahoo require a one-click unsubscribe header for bulk mail:

List-Unsubscribe: <https://example.com/unsub>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Test it instead of guessing