How to Verify SPF, DKIM, and DMARC Are Configured

Why You Need to Check All Three (and in This Order)

To verify SPF, DKIM, and DMARC for any domain you manage, you need three DNS queries and one email header to find your DKIM selector. This guide shows exactly what to run and what to look for in each result.

Check them in this order: SPF first, then DKIM, then DMARC. DMARC is a wrapper that depends on the other two. If SPF or DKIM is broken, DMARC fails too, but you may not know which one is the culprit without checking in sequence. Systematic checking catches those drift cases before they become production problems.

How to Check SPF Records

SPF (Sender Policy Framework) is a DNS TXT record published at your domain that lists every IP address allowed to send email on its behalf.

Using dig (command line)

Open a terminal and run:

dig TXT yourdomain.com

Look for a record that starts with v=spf1. A valid SPF record for a Google Workspace domain looks like this:

v=spf1 include:_spf.google.com ~all

The v=spf1 tag identifies the record type. The include: directive pulls in Google's authorized IP list. The ~all tag means "soft fail" -- servers should deprioritize emails from unlisted sources but not necessarily reject them outright. Changing ~all to -all makes the policy strict.

Common SPF mistakes that cause failures

The most common SPF errors are:

Multiple SPF records: DNS allows only one SPF record per domain. Multiple records cause a permerror and most major receivers treat that as a fail.
More than 10 DNS lookups: The SPF specification limits the number of DNS lookups a record can trigger to 10. Exceed that and receivers may reject or permerror the record.
Include statements that do not resolve: If an included domain's DNS is broken, your SPF fails silently for some receivers.

Quick syntax check

If you want a clean read of just the SPF record:

dig TXT yourdomain.com +short | grep "v=spf1"

If nothing returns, no SPF record is published.

How to Check DKIM Records

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to email headers. The receiving server uses a public key published in DNS to verify that signature.

Finding your DKIM selector

Unlike SPF, DKIM is not published at the root domain. It lives at a selector subdomain. Common selectors include default, google, mail, or custom names specific to your email provider.

If you use Google Workspace, your selector is typically google. For Microsoft 365, it is often selector1 or selector2 depending on the tenant.

To find the right selector for a domain, look at an actual email header from that domain and search for the dkim= tag. That value is your selector.

Using dig to verify the DKIM record

Once you have the selector, run:

dig TXT selector._domainkey.yourdomain.com

For example, with Google Workspace:

dig TXT google._domainkey.example.com

A valid DKIM record starts with v=DKIM1 and includes a k= tag (the key type, usually rsa) and a p= tag (the public key).

If p= is empty or missing, the key has been revoked and emails signed with that private key will fail DKIM verification.

What DKIM alignment actually means

DKIM alignment is the connection between the domain in the DKIM signature header (d=) and the domain in the email's From header. For DMARC to pass based on DKIM, those two domains must match exactly (or be a subdomain, depending on your policy).

A DKIM signature can be valid and still fail DMARC if the signing domain does not align with the From domain.

How to Check DMARC Records

DMARC (Domain-based Message Authentication, Reporting, and Conformance) lives at _dmarc.yourdomain.com as a DNS TXT record.

The DMARC DNS lookup

Run:

dig TXT _dmarc.yourdomain.com

A basic DMARC record looks like:

v=DMARC1; p=none; rua=mailto:reports@example.com; ruf=mailto:failures@example.com

What each tag means

v=DMARC1 -- version identifier, must be present
p= -- policy instruction for receiving servers

- p=none -- monitor only, take no action - p=quarantine -- treat unauthenticated mail as suspicious - p=reject -- refuse delivery of unauthenticated mail

rua= -- aggregate report destination (one summary email per day per receiving server)
ruf= -- forensic report destination (immediate reports on individual failures)

What rua and ruf do and why they matter

Aggregate reports (rua) give you a overview of who is sending mail that appears to come from your domain and whether it authenticates. Forensic reports (ruf) give you per-incident details but are not widely supported -- most major receivers only send aggregate reports.

If you see p=none and no rua= address, you are running blind. You have a DMARC record but no visibility into what is actually happening with your domain's mail.

Why SPF and DKIM Must Both Align for DMARC to Pass

DMARC requires at least one of SPF or DKIM to produce an aligned result. "Aligned" means the domain in the authentication result matches the domain in the email's From header.

For SPF, alignment means the envelope-from domain (the MAIL FROM domain used in SMTP) matches the From header domain.

For DKIM, alignment means the d= domain in the DKIM signature matches the From header domain.

If neither SPF nor DKIM is aligned, DMARC fails regardless of whether individual checks pass.

This is why DMARC can fail even when SPF and DKIM both show a pass in isolation. The pass happens on the wrong domain. The alignment check is the missing piece.

Quick Verification Checklist for Any Domain

Run these four checks in order:

1. dig TXT yourdomain.com -- SPF record present and syntactically valid
2. dig TXT selector._domainkey.yourdomain.com (swap in your actual selector) -- DKIM key present and not revoked
3. dig TXT _dmarc.yourdomain.com -- DMARC record published
4. Check your DMARC aggregate reports -- something must be receiving and processing them

For each check, confirm: the record exists, the syntax is valid, and the domains match what you expect.

These four checks give you a point-in-time snapshot. Running them manually is fine for a one-time audit. If you manage multiple domains or add new sending services regularly, those snapshots go stale fast. DMARCFlow monitors all three records continuously and alerts you when something changes, so you catch drift before it affects mail delivery.

What to Do When One Record Fails

If SPF fails: check whether all your authorized senders are listed in the record, including any third-party services (CRM tools, marketing platforms, helpdesks) that send email on your behalf. Update the SPF record to include their include statements.

If DKIM fails: the most common cause is a key rotation that was not completed properly. If your email provider rotated their DKIM key and you did not update the DNS record, the old key is no longer valid. Contact your email provider for the current DKIM public key.

If DMARC fails even when SPF and DKIM both pass: check alignment. The signing domain (for DKIM) or envelope-from domain (for SPF) must match the From header domain. Forwarded email is a common cause -- when someone forwards your email, the envelope-from changes and alignment breaks.

If you are managing one domain, these checks are enough for an audit. If you manage multiple domains or an MSP roster, manual checks become a liability. Email authentication records drift. A service that sends on your behalf may change its sending IP without notifying you. A DKIM key rotation may publish the new key in DNS but leave the old selector active for a window. The commands above give you a point-in-time snapshot. DMARCFlow continuously monitors all three records for every domain you manage and alerts you when something changes, so misconfigurations surface before they cause mail delivery failures rather than after.

Frequently Asked Questions

How do I check SPF DKIM and DMARC from the command line?

Run these three commands:

dig TXT yourdomain.com              # SPF
dig TXT selector._domainkey.yourdomain.com  # DKIM
dig TXT _dmarc.yourdomain.com       # DMARC

What is the dig command to check DMARC records?

dig TXT _dmarc.yourdomain.com

Why does DMARC fail when SPF and DKIM both pass?

Because DMARC requires alignment, not just pass/fail results. The domain in the SPF check or DKIM signature must match the From header domain. If they differ, DMARC fails even though the individual authentication checks succeeded.

What is a DKIM selector and how do I find mine?

A DKIM selector is a prefix that identifies which DKIM key pair a domain is using. It is published as a subdomain of your domain (e.g., google._domainkey.example.com). To find yours, open an email header from the domain you are checking and look for the dkim= tag, or contact your email provider.

How often should I verify email authentication records?

At minimum when you make any change to your email infrastructure: adding a new sending tool, switching providers, or changing your DNS. For ongoing assurance, a monitoring service that checks records daily and alerts on changes is more reliable than periodic manual checks.