SPF, DKIM and DMARC: how to check what is wrong with your email setup (and fix it)
Your emails land in spam, and you do not know why. Here is a short checklist to find out.
1. SPF: who may send for your domain
SPF is a DNS TXT record listing the servers allowed to send mail for your domain.
example.com. TXT "v=spf1 include:_spf.your-provider.com -all" Common mistakes: more than 10 DNS lookups, two SPF records on one domain, or +all.
2. DKIM: proof the mail was not changed
Your sending service signs each mail. You publish the public key as a TXT record under selector._domainkey.example.com. Check that the selector in the mail header (DKIM-Signature: s=...) matches a record that exists and uses at least 1024, better 2048 bits.
3. DMARC: what receivers should do on failure
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com" Start with p=none, read the reports, then move to quarantine and reject.
4. The rest that gets forgotten
- Reverse DNS (PTR) of your sending IP must match the hostname the server announces
- The IP and the domain must not be on blocklists
- TLS between servers should work
- Gmail and Yahoo require a one-click unsubscribe header for bulk mail:
List-Unsubscribe: <https://example.com/unsub> List-Unsubscribe-Post: List-Unsubscribe=One-Click Test it instead of guessing
Send a mail to a test address and look at the result. I built a free tool for that: https://postwacht.de/en?ref=devto It runs these checks, gives a score and shows the exact DNS record for each problem. No signup needed.