How to Check Email Authentication (SPF, DKIM, DMARC)

Good email authentication requires all three components — SPF, DKIM, and DMARC — to be correctly configured and aligned. DomainScan checks all of them in one report.

Running the Check

Navigate to /domain/email and enter any domain. The checker:

1. Fetches the SPF TXT record from DNS
2. Probes for DKIM records using common selectors
3. Fetches the DMARC record from _dmarc.domain.com
4. Evaluates alignment and policy strength
5. Returns a plain-English summary with specific findings

Reading the SPF Section

Status: Pass

Your SPF record is syntactically valid, doesn’t exceed the 10-lookup limit, and includes at least one IP range or include mechanism.

Status: Warning

Common warnings:

• ~all qualifier instead of -all — soft-fail allows some spoofing through spam filters
• Lookup count near the 10-limit — at risk of PermError if sending services add IPs
• ?all (neutral) — provides no protection at all

Status: Fail

Common failures:

• No SPF record found
• SPF record exceeds 10 DNS lookups (PermError)
• SPF record has a syntax error
• Multiple SPF TXT records at the same domain (PermError — only one allowed)

How to fix multiple SPF records: merge all mechanisms into a single record:

; Wrong — two separate TXT records:
example.com  TXT  "v=spf1 include:_spf.google.com ~all"
example.com  TXT  "v=spf1 include:sendgrid.net ~all"

; Correct — single merged record:
example.com  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

Reading the DKIM Section

DKIM records aren’t automatically discoverable — they live at selector._domainkey.domain.com and you must know the selector. DomainScan probes these common selectors automatically:

• google (Google Workspace)
• mail, default, dkim (common defaults)
• s1, s2, k1 (SendGrid, Mailchimp)
• selector1, selector2 (Microsoft 365)

Status: Pass

At least one valid DKIM record found with a parseable public key.

Status: Warning

• Key uses 1024-bit RSA — should upgrade to 2048-bit or Ed25519
• t=y flag present — DKIM is in test mode, failures aren’t enforced
• Key looks valid but selector was a common guess — confirm your actual selector

Status: Not Found

No DKIM records found on common selectors. Either:

• DKIM isn’t set up (most likely)
• You use a non-standard selector — enter it manually
• Key was revoked (empty p= field)

Entering a Custom Selector

If your email provider uses a non-standard selector (e.g., smtp2go, em1234, scph1220):

1. Find your selector in your email provider’s DKIM settings
2. Enter it in the “Custom selector” field in DomainScan’s email checker
3. The full record name will be: yourselector._domainkey.yourdomain.com

Reading the DMARC Section

Policy Strength

Alignment

DMARC alignment check — requires either:

• SPF: envelope sender (Return-Path) domain aligns with From: domain
• DKIM: signing domain (d=) aligns with From: domain

If neither aligns, even a valid SPF and DKIM won’t produce a DMARC pass.

Reporting

If rua= is missing, you receive no aggregate reports — you can’t see who’s sending email using your domain. Always add rua=mailto:dmarc@yourdomain.com or use a third-party DMARC reporting service.

Overall Authentication Score

DomainScan gives an overall score (0-100) based on:

• SPF present and valid (20 pts)
• SPF -all qualifier (10 pts)
• DKIM present and valid (25 pts)
• DKIM key ≥2048 bits (5 pts)
• DMARC present (20 pts)
• DMARC p=reject or p=quarantine (15 pts)
• DMARC rua= reporting set up (5 pts)

A score below 60 means your domain is vulnerable to spoofing. A score of 90+ means you have solid protection.

Checking Third-Party Sending Domains

If you use marketing or transactional email services, check them too:

• yourdomain.mailchimpsites.com or your custom sending domain
• Your transactional subdomain: mail.yourdomain.com, em.yourdomain.com

Each subdomain that sends email needs its own SPF, DKIM, and DMARC configuration.