You published your DNS records. Now how do you know they work? There are three reliable ways to check email authentication: look up the DNS records directly, send a real message and read its headers, and use an online checker. This guide shows each one and what the results mean.
Method 1: Look up the DNS records
All three standards live in TXT records, so any DNS lookup tool works. On macOS and Linux use dig; on Windows use nslookup or PowerShell.
SPF is a TXT record at the domain itself:
dig +short TXT yourdomain.com
"v=spf1 ip4:203.0.113.25 include:_spf.example.net ~all"DKIM needs the selector. You find it in the s= tag of a real message, or in your sending provider's instructions:
dig +short TXT mail2026._domainkey.yourdomain.com
"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."DMARC is at the _dmarc name:
dig +short TXT _dmarc.yourdomain.com
"v=DMARC1; p=none; rua=mailto:[email protected]"On Windows PowerShell the equivalent is Resolve-DnsName -Type TXT _dmarc.yourdomain.com.
What to look for:
| Record | Healthy | Problem |
|---|---|---|
| SPF | Exactly one v=spf1 record, under 10 lookups | Two records, or permerror (see lookup limit) |
| DKIM | A p= value that is long and unbroken | Empty answer, wrong selector, truncated key |
| DMARC | Exactly one v=DMARC1 record | None, or more than one |
If a lookup returns nothing right after you added a record, give it time. See how long DNS propagation takes.
Method 2: Send a message and read the headers
DNS only tells you the records exist. The headers of a received message tell you whether the receiver accepted them. Send a message from the domain to a Gmail address you control, then open the message, choose the three-dot menu, and pick Show original. Gmail prints a summary:
SPF: PASS with IP 203.0.113.25
DKIM: PASS with domain yourdomain.com
DMARC: PASSUnderneath is the raw Authentication-Results header, which most providers add:
Authentication-Results: mx.google.com;
dkim=pass [email protected] header.s=mail2026;
spf=pass [email protected];
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=yourdomain.comRead it like this:
dkim=pass header.s=mail2026means the selectormail2026verified.spf=pass smtp.mailfrom=...is the envelope sender that SPF checked.dmarc=pass header.from=yourdomain.commeans at least one aligned check passed for your visible From domain.
Typical failures:
| Result | Likely cause |
|---|---|
spf=softfail or fail | Sending IP not in your SPF record |
spf=pass but dmarc=fail | SPF passed for another domain, so it is not aligned |
dkim=none | The message was not signed at all |
dkim=fail (body hash did not verify) | Something changed the message after signing |
dkim=neutral (no key for signature) | Selector or DNS name wrong |
Method 3: Use an online checker
Online tools take a domain name and show the records, count SPF lookups and flag syntax errors. Some also let you send a message to a temporary address and then analyse it. They are quick and good for catching typos, but they only see public DNS. They cannot tell you whether your sending system is actually signing, so still do the header test at least once.
A debugging order that saves time
- Is the record published at the exact name? (Typos in
_domainkeyand_dmarcare common.) - Is there exactly one SPF and one DMARC record?
- Does the message carry a
DKIM-Signaturewithd=equal to your domain? - Do the SPF and DKIM domains match the From domain (alignment)?
- Has the TTL of an older cached record expired?
Test without cluttering your own inbox
When you are iterating on records you will send many test messages. A public temporary inbox is handy for that, because you can pick any address and read the headers without creating accounts. Be careful what you send there: anyone who knows the address can read it. See what a temporary email address is for when it is a good idea.
What Mailions checks for you
For each domain, Mailions lists the MX, SPF, DKIM and DMARC records you need and a Check DNS button that reads live public DNS and tells you which record is missing or different, with a hint such as "found two SPF records, merge them". Verification proves the records are published; whether a given message lands in the inbox still depends on reputation and content, which no checker can promise.