How to check SPF, DKIM and DMARC records
Trace email authentication problems using DNS records and the Authentication-Results header of a test message.
Test each sending channel
Regular business email and store receipts may come from separate services. Send a test message from each channel to an inbox you control. Open the original message and find the receiving system’s Authentication-Results header. Compare spf=, dkim= and dmarc= with the records. A published record does not establish that every sender uses it correctly.
Look up SPF on the envelope sender
SPF checks whether the connecting server may send on behalf of the envelope domain, which can differ from the visible From address. Look for smtp.mailfrom and query its TXT record starting with v=spf1. Combine authorized senders in one policy, not multiple SPF records. Too many DNS lookups can also cause an error. MX identifies inbound mail servers.
Check DKIM and DMARC alignment
Use s= and d= in DKIM-Signature. With s=shop and d=example.com, look up shop._domainkey.example.com. Some providers publish a CNAME leading to the key. A dkim=pass result means the signature verified. DMARC needs a passing SPF or DKIM result aligned with the visible From domain. Check _dmarc.example.com and header.from together.
Send a new message after changes
Earlier message headers will not change. Retest each sender and inventory legitimate channels before enforcing a stricter DMARC policy. If authentication passes but delivery is still poor, review the recipient’s diagnostic message, sender reputation and actual outgoing IP.
DNS lookup
Look up the sender’s TXT and _dmarc records, and use a sample message to find the DKIM selector.
Open the tool