Email setup checks (SPF, DKIM, DMARC)
What each record does and how to fix the common problems.
What's checked
Once a day Pingerer reads your domain's SPF, DKIM, DMARC and MX records. Problems that get email lost or spoofed fail the check; weaker settings pass but are listed as warnings on the monitor.
| Finding | Result |
|---|---|
| No SPF record (on a domain that receives mail) | Fails |
| Two or more SPF records | Fails: receivers ignore them all |
SPF ends in +all | Fails: anyone can send as you |
| No DMARC record (on a domain that receives mail) | Fails |
SPF ends in ?all, or has no all | Warning |
DMARC p=none | Warning: it monitors but doesn't protect |
| No DKIM key at the usual selectors | Warning |
The checked DKIM selectors are google, default, selector1, selector2, k1 and s1, which cover Google Workspace, Microsoft 365 and many sending services. Add your own selector on the monitor if yours is different.
SPF
One TXT record on your domain listing who may send for you, ending in ~all or -all:
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~allIf you have two SPF records (common after adding a newsletter tool), merge them into one.
DKIM
Your email provider gives you a DKIM record to publish (a TXT or CNAME at selector._domainkey.yourdomain.com). Turn DKIM signing on in the provider's settings too.
DMARC
Start by monitoring, then tighten once reports look clean:
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
# later
_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"Still stuck? Contact us and a person will reply.