DEV Community

Cover image for SPF, DKIM and DMARC: how to check what is wrong with your email setup (and fix it)
postwacht
postwacht

Posted on

SPF, DKIM and DMARC: how to check what is wrong with your email setup (and fix it)

#security #email #devops #tutorial

Your emails land in spam, and you do not know why. Here is a short checklist to find out.

1. SPF: who may send for your domain

SPF is a DNS TXT record listing the servers allowed to send mail for your domain.

example.com.  TXT  "v=spf1 include:_spf.your-provider.com -all"
Enter fullscreen mode Exit fullscreen mode

Common mistakes: more than 10 DNS lookups, two SPF records on one domain, or +all.

2. DKIM: proof the mail was not changed

Your sending service signs each mail. You publish the public key as a TXT record under selector._domainkey.example.com. Check that the selector in the mail header (DKIM-Signature: s=...) matches a record that exists and uses at least 1024, better 2048 bits.

3. DMARC: what receivers should do on failure 

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
Enter fullscreen mode Exit fullscreen mode

Start with p=none, read the reports, then move to quarantine and reject.

4. The rest that gets forgotten

  • Reverse DNS (PTR) of your sending IP must match the hostname the server announces
  • The IP and the domain must not be on blocklists
  • TLS between servers should work
  • Gmail and Yahoo require a one-click unsubscribe header for bulk mail:
Enter fullscreen mode Exit fullscreen mode

Test it instead of guessing

Send a mail to a test address and look at the result. I built a free tool for that: https://postwacht.de/en?ref=devto It runs these checks, gives a score and shows the exact DNS record for each problem. No signup needed.

Top comments (0)