Help center / Checks

Email setup checks (SPF, DKIM, DMARC)

What each record does and how to fix the common problems.

On this page
  1. What's checked
  2. SPF
  3. DKIM
  4. DMARC

What's checked

Once a day Pingerer reads your domain's SPF, DKIM, DMARC and MX records. Problems that get email lost or spoofed fail the check; weaker settings pass but are listed as warnings on the monitor.

FindingResult
No SPF record (on a domain that receives mail)Fails
Two or more SPF recordsFails: receivers ignore them all
SPF ends in +allFails: anyone can send as you
No DMARC record (on a domain that receives mail)Fails
SPF ends in ?all, or has no allWarning
DMARC p=noneWarning: it monitors but doesn't protect
No DKIM key at the usual selectorsWarning

The checked DKIM selectors are google, default, selector1, selector2, k1 and s1, which cover Google Workspace, Microsoft 365 and many sending services. Add your own selector on the monitor if yours is different.

SPF

One TXT record on your domain listing who may send for you, ending in ~all or -all:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

If you have two SPF records (common after adding a newsletter tool), merge them into one.

DKIM

Your email provider gives you a DKIM record to publish (a TXT or CNAME at selector._domainkey.yourdomain.com). Turn DKIM signing on in the provider's settings too.

DMARC

Start by monitoring, then tighten once reports look clean:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"
# later
_dmarc.yourdomain.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"

Still stuck? Contact us and a person will reply.