# Check SPF, DKIM and DMARC for Your Sending Domain

Checking SPF, DKIM and DMARC means reviewing the three DNS records that tell receiving mail servers whether a sender is authorised to use your domain. Correct records do not guarantee inbox placement, but without them some messages may be rejected, sent to spam or look suspicious to the recipient.

## What this domain check reviews before outreach

The tool reads the domain’s public DNS records and checks their structure. SPF identifies authorised sending sources, DKIM checks for a public signing key, and DMARC sets the domain’s instruction for a receiving server when authentication does not align. This is an initial technical check before connecting mailboxes and sending your first outreach wave.

| Check | What it looks for | What a failure means |
|---|---|---|
| SPF | One TXT record listing authorised sending services | The sending server is missing or the record conflicts |
| DKIM | A public key published under a selector | The message signature cannot be verified |
| DMARC | A policy and, where needed, a reporting address | The domain gives no instruction for unverified mail |

The check reads published DNS data, not the settings inside your email account. A record can therefore look correct while messages are still unsigned because DKIM has not been enabled for the relevant mailbox. See the [practical SPF, DKIM and DMARC setup guide](/en/guides/spf-dkim-dmarc-setup/) for the configuration and verification sequence.

## How to read an SPF result without false confidence

SPF answers one question: has the domain owner authorised this email service to send mail? A working record usually begins with `v=spf1`, lists permitted mechanisms and ends with a policy, often `-all` or `~all`. Two separate SPF TXT records for one domain are an error, because a receiving server may return an indeterminate result.

A common situation is that routine correspondence is sent through one service and outreach through another, but only the first is included in SPF. The outreach message then comes from an unauthorised source and cannot support DMARC authentication. Do not add services blindly: first list every real sending source and follow its SPF guidance.

A long SPF chain with many nested `include` mechanisms can also fail because receiving servers limit DNS lookups during validation. The tool can flag a complex record, but simplifying it requires an inventory of the services that actually send on your behalf.

## Why DKIM matters even when SPF passes

DKIM adds a cryptographic signature to an email. The recipient retrieves the public key from DNS and verifies that important parts of the message were not altered after sending. It is a separate check: SPF concerns the sending source, while DKIM concerns the signature and the domain named in it.

The selector and key matter in the result. If the selector in an email header does not match the DNS subdomain, or the key was published incorrectly, the signature will fail. After publishing a record, send a test email to an external address and inspect the technical headers for `dkim=pass`, not merely for the presence of a DNS record.

Before a campaign, DNS checks should sit alongside [email list verification](/en/services/list-verification/). A clean list cannot compensate for an invalid domain signature, but it does reduce avoidable delivery failures.

## How DMARC connects the visible From domain to authentication

DMARC does more than check whether SPF or DKIM passed. It compares the domain in the visible From field with the domain that passed SPF or DKIM; this is called alignment. A message can show `spf=pass` but still fail DMARC if the authenticated domain is unrelated to the sender address.

- Start with a DMARC record in monitoring mode so you can collect information without asking receivers to reject messages.
- Check test sends from every email service you use and identify sources that are not aligned.
- Only tighten the policy after correcting the issues, if your email setup requires it.

For example, a message may show `name@company.ru` in the From field while the sending service signs with its own platform domain. The recipient sees your name, but the receiving server cannot connect that signature to `company.ru`. See the glossary entries for [SPF](/en/glossary/spf/), [DKIM](/en/glossary/dkim/) and [DMARC](/en/glossary/dmarc/).

## What a DNS record check cannot tell you

A DNS check does not measure domain or IP reputation, message content, recipient complaints, list quality or actual inbox placement. It also cannot see private email-service settings, such as whether signing is enabled for a particular mailbox, which Return-Path is used or how a platform modifies a message during sending.

This tool is not a complete readiness test for a large launch. If records pass but messages do not arrive or land in spam, the domain, mailboxes, list and sending scenario need to be reviewed together. In that case, consider a [cold outreach and deliverability audit](/en/services/outreach-audit/).

## Frequently asked questions

**Can I send email without DMARC?**

An email can technically be delivered without DMARC. However, the domain does not publish handling instructions for unauthenticated messages, and SPF and DKIM are not evaluated as a complete aligned system.

**Why is SPF found but still reported as an error?**

Common causes are multiple SPF records, invalid syntax or an unlisted sending service. Another possibility is exceeding the permitted number of DNS lookups through nested `include` chains.

**Do I need to create a DKIM key myself?**

Usually, your email provider generates the key and gives you a TXT record to publish in DNS. You still need to enable signing in the provider’s settings and confirm it in the headers of a test message.

**When will DNS changes become visible?**

Timing depends on the record’s TTL and on DNS cache refreshes. Do not treat the work as complete until a public check sees the new record and a test message shows successful authentication.

**Is setting up the company’s main website domain enough?**

Records on the primary website domain do not replace configuration for the domain that actually sends email. Check the domain in the sender address and the signing arrangement used by the email service.

---
Source: https://ot9.ru/en/tools/spf-dkim-dmarc-check/ · OT9 (KAP Group) · updated 2026-08-10