Guides · Updated October 26, 2026 · Not legal advice; provider rules change, so check the linked sources.

How to check your SPF, DKIM and DMARC records

All three are DNS TXT records, so you can check them with free command-line tools. Or you can use the free scan, which does it for you.

SPF

dig +short TXT yourdomain.com
nslookup -type=TXT yourdomain.com

Look for the record that starts v=spf1. Check that:

There is exactly one SPF record. Two or more is a permanent error under RFC 7208.
Every service that sends as you is included, for example include:_spf.google.com for Google Workspace.
It stays within the 10 DNS-lookup limit (RFC 7208 section 4.6.4). Each include, a, mx, ptr, exists and redirect counts, including nested ones.
It ends with ~all (softfail) or -all (fail), not +all, which authorizes anyone.

DKIM

DKIM public keys are published at <selector>._domainkey.yourdomain.com (RFC 6376). The selector is chosen by your email provider, so first find it in a real message:

Send yourself an email and open "Show original" (Gmail) or "View source".
Find the DKIM-Signature: header and note d= (the signing domain) and s= (the selector).
Look it up:
```
dig +short TXT s1._domainkey.yourdomain.com
```
Replace s1 with your selector. Some providers publish a CNAME that points to their key.

The same "Show original" view in Gmail shows SPF, DKIM and DMARC as PASS or FAIL for that message. That's the quickest end-to-end check.

DMARC

dig +short TXT _dmarc.yourdomain.com

You should see one record starting v=DMARC1, with a p= policy and ideally a rua= address for reports. See DMARC basics for what the tags mean.

Reading the results

No SPF or DKIM: under Google's and Yahoo's rules, mail to Gmail and Yahoo is at risk (see bulk-sender rules).
SPF and DKIM pass, but DMARC fails: usually an alignment problem. The service is authenticating with its own domain instead of yours. Set up a custom sending domain or DKIM in that service.
DMARC at p=none for a long time: you're monitoring but not protected. Plan a staged move to enforcement.

Check your own domain in seconds. The free ExclusiveTrust scan looks up your SPF, DKIM and DMARC records and tells you, in plain English, what is missing.