SPF vs DKIM vs DMARC
Three DNS records that prove a message really came from your domain.
| Record | What it does | Where it goes |
|---|---|---|
| SPF | Lists the servers allowed to send email for your domain | TXT record on the domain itself (@) |
| DKIM | A digital signature on every message proving it wasn’t altered | TXT or CNAME record at selector._domainkey |
| DMARC | Tells receivers what to do when a message fails, and sends you reports | TXT record at _dmarc |
Why is my email going to spam?
No SPF, or a broken one. If you use several services, like company email plus a store that sends invoices, they all belong in one SPF record.
Over the limit of ten. SPF allows only 10 DNS lookups. Every include adds one or more, and past ten the whole SPF check fails.
DKIM isn’t turned on. Enable it in your email provider’s settings and copy the record it gives you into DNS.
No DMARC. Google and Yahoo require DMARC from anyone sending over 5,000 messages a day, and p=none is enough to start.
FAQ
What’s the difference between ~all and -all?
~all marks mail from other servers as suspicious, so it usually goes to spam. -all says reject it. Start with ~all until you’re sure every sender is in the record, then move to -all if you want.
What does Gmail require from senders?
Since 2024, Google requires everyone sending to Gmail to have valid SPF or DKIM. Anyone sending more than 5,000 messages a day needs SPF, DKIM and DMARC together, and a p=none policy is enough.
What is a DKIM selector?
A name that identifies a DKIM key; the record lives at selector._domainkey.yourdomain. Google uses google, Microsoft 365 uses selector1 and selector2. We try the common names; if we don’t find yours, type the name from your email settings.
Why does the check say there are more than 10 lookups?
Every include, a and mx in the record needs a DNS lookup, and so does every include inside the services you added. Remove services you no longer use, or replace an include with IP addresses if they’re fixed.
Do I add a new SPF record for each service?
No. A domain must have exactly one SPF record. Add every service to the same record; the generator here combines them for you.
How do I add the record at my DNS provider?
Open your domain’s DNS settings, add a TXT record, enter the name (@ for SPF, _dmarc for DMARC) and paste the value. The change usually shows within minutes to an hour.
Do you store the domains I check?
No. Your browser asks public DNS services (Google, with Cloudflare as backup) directly; nothing passes through Webnaa’s servers.