IT Toolbox
Guide

How to check SPF, DKIM and DMARC records together

The delivability depends on the actual behaviour of the sender and not only the presence of three DNS records.

TopicIT Networking →
⌚ About 2 min read
View my favorites
Message. Intermediate. 20 min

The delivability depends on the actual behaviour of the sender and not only the presence of three DNS records.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Identify the sender

    Note envelope-(3) and From.

  2. 2

    Check SPF

    The path of shipment must be allowed.

  3. 3

    Check for DKIM

    Control selector and signature.

  4. 4

    Check DMARC

    Analyze alignment and policy.

Commands utiles

ns Outlookup -type=txt example.com
ns Outlookup -type=txt _dmarc.example.com

À retenir

  • Avoid multiple separate SPF records.
  • Pass DMARC to the mlan only after sufficient observation.
← All les guides
Technical deep dive

SPF + DKIM + DMARC: read all three results in the same message

Technical checkpoints

  • SPF applies to the envelope, DKIM to a d= signature, and DMARC to alignment with the visible From domain.
  • DMARC can pass with aligned DKIM even when SPF fails, or vice versa.
  • Authentication-Results is the best starting point to correlate pass/fail results with actual domains used.

Expected header

Read a received message and compare smtp.mailfrom, header.d and header.from.

Authentication-Results: ... spf=pass ... dkim=pass ... dmarc=pass

Topic-specific pitfalls

  • Testing DNS records separately without a real message does not prove alignment for the sending flow.
  • Forwarding can break SPF while preserving DKIM, which explains some DMARC scenarios.

How to validate

  • A message from each legitimate source shows dmarc=pass and at least one aligned mechanism.
  • Envelope and signature domains match the documented architecture.
♡ 0