Are your emails set up to arrive?
Three lines of DNS decide whether your mail reaches an inbox or a spam folder.
The records nobody revisits
SPF, DMARC and DKIM are set up once, on the day the domain is bought, usually by pasting whatever a provider's help page said. Then services get added, providers get swapped, and nobody looks at them again.
Anyone can send as you
An SPF record ending in +all authorises the entire internet to send mail from your domain. It is one character away from the strict version, and it is written by hand more often than you would think.
A policy that protects nothing
DMARC at p=none is watch and report, do not act. It is the correct place to start and it is where most domains have been sitting for years, doing nothing at all.
Adding one service breaks the lot
SPF is allowed ten DNS lookups. Add one more provider and the whole record fails permanently, which receivers treat as having no SPF. Nothing warns you.
Records in, an answer out
Look up your records
dig +short TXT yourdomain.com, then the same for _dmarc.yourdomain.com. Both are public.
Paste them here
One per line, in any order, exactly as they came back. The check runs in your browser.
See what they actually do
In plain words, worst first, with the line to change and what to change it to.
What it checks
Whether anyone can send as you
The all mechanism at the end of SPF, which is the part that actually decides. +all authorises everybody, and ?all decides nothing at all.
Two SPF records, which means none
A domain may have exactly one. With two the check fails permanently, and that is what happens when a second provider publishes its own instead of being merged in.
The ten-lookup ceiling
Counts the lookups in your record and warns before the edge, because every include: costs more inside it and pushes you over without the record changing.
Whether DMARC enforces or watches
p=none protects nothing, and a record with no p= at all is discarded whole, taking your reporting address with it.
Whether reports reach you
Without a rua address you cannot see who is sending as your domain, which is the one thing that makes it safe to start enforcing.
Revoked and undersized DKIM keys
An empty key is how a selector is revoked: the record still exists, so nothing looks missing, and everything it signs fails.
Straight talk about what it cannot see
It reads the records you paste. A browser cannot query DNS, and the difference that makes is worth stating.
It cannot look your domain up
So it cannot tell a record that is missing from DNS from one that is merely missing from what you pasted. If a record is not there, paste nothing and it will say so.
SPF lookups are a floor, not a count
It counts what is written in your record. Every include: pulls in another record with its own lookups, so the true number is at least this and usually more.
DKIM lives at a name you have to know
There is no way to guess your selector, so DKIM has to be looked up by hand. Your provider names it.
Correct records are not delivery
These three stop your mail being rejected outright. Whether it lands in the inbox also depends on your reputation, your content and how you send.
Two commands and a paste
The domain you send invoices and password resets from is worth two minutes of checking.