Technical guide

How to check SPF, DKIM, and DMARC correctly

The three controls work together but answer different questions. A useful check covers syntax, resolution, authentication, and alignment.

LuminaKite Security TeamPublished: 2026-07-216 min read

The problem

Copying provider records can create excessive SPF lookups, incorrect DKIM selectors, or a DMARC policy with no useful reporting. A TXT record existing does not prove mail authenticates correctly.

Risks and assumptions

Easier domain impersonation without aligned policy.

Legitimate mail sent to spam or rejected after configuration errors.

False confidence from checking record presence only.

Procedure

Inspect SPF

Publish one record, use a clear terminal mechanism, and stay within the DNS-lookup limit.

Check DKIM

Use the selector for each sender and validate both the public key and a test-message signature.

Validate DMARC

Review version, policy, aggregate-report destination, percentage, and subdomain policy.

Evaluate alignment

At least one authenticated domain must align with the visible From domain under relaxed or strict mode.

Test real sending paths

Include workforce mail, marketing, support, billing, and forwarding scenarios.

Limits of a manual approach

A DNS lookup cannot prove how a real message is signed.

DKIM has no universal selector; it is sender-specific.

SPF often breaks during forwarding.

Example

A SaaS sender can be included in SPF yet fail DMARC when Return-Path is not aligned and DKIM uses the vendor domain. Fix aligned signing in the vendor configuration rather than trusting the SPF pass alone.

Common mistakes

Publishing multiple SPF records.

Looking up DKIM without the real selector.

Leaving `p=none` indefinitely without reviewing RUA.

Recommendations

Document every sender and its alignment method.

Validate delivered test messages, not just setup wizards.

Monitor both record changes and aggregate outcomes.

Frequently asked questions

Must SPF and DKIM both pass?

DMARC needs at least one to pass and align; keeping both healthy improves resilience.

Can a name have multiple SPF records?

No. Publish one SPF record and combine mechanisms carefully.

Where do I find the DKIM selector?

The sender provides it, or it appears in the `s=` parameter of a DKIM signature on a test message.

Monitor email authentication

Detect record changes and follow SPF, DKIM, and DMARC posture over time.

Explore the module