Check Your Email Domain Setup (MX, SPF, DKIM, DMARC) in 15 Minutes

If your business emails land in spam, bounce, or never arrive, the cause is often not your email program. It is the small text records attached to your domain name that tell the world which servers may receive and send mail for you. This guide shows you how to check those records in about 15 minutes, using free tools and no technical background.

You do not need to log in to your server. You only need your domain name (for example example.com) and, if you want to fix something, access to wherever you manage your domain's DNS. If DNS is new to you, skim DNS explained for website owners first.

What you are checking, in plain words

Four kinds of records matter for email:

• MX records say where incoming mail for your domain should be delivered. If they are wrong or missing, you do not receive email.
• SPF is a list of the servers allowed to send mail as your domain. Receiving servers compare the sender against the list.
• DKIM adds a digital signature to every message you send. The matching public key is published in DNS so receivers can verify the message was not altered and really came from your domain.
• DMARC tells receivers what to do when SPF and DKIM checks fail, and where to send reports.

A healthy small-business domain has MX records that match your email provider, exactly one SPF record, a DKIM key for each service that sends mail, and a DMARC record. For the long version, read SPF, DKIM and DMARC: the complete guide.

Step 1: Write down who sends email for your domain

Before you test anything, list every service that sends mail using your domain name. Most small businesses have more than one:

1. Your main mailbox provider, such as Google Workspace or Microsoft 365.
2. Your website, for contact-form and order emails.
3. A newsletter tool.
4. Billing, booking or support software.

This list matters because SPF and DKIM must cover all of them. A common failure is that the main mailbox works, but the newsletter tool was never added, so its messages fail checks.

Step 2: Check your MX records

1. Open the MX लुकअप tool.
2. Type your domain (without https:// or www) and run the lookup.
3. Compare the results with what your email provider says they should be.

Two examples of what you should see, depending on provider. Google Workspace currently publishes smtp.google.com as its single MX record, with older setups using aspmx.l.google.com and several alternates. Microsoft 365 uses a hostname ending in mail.protection.outlook.com. Provider instructions change, so always compare with your provider's current setup page. Our guides for Google Workspace DNS records और Microsoft 365 DNS records list what to look for.

Red flags:

• No MX records at all. Mail to your domain will not arrive (or senders may fall back to your web server, which is rarely what you want).
• MX records from two different providers. Mail splits unpredictably between them. This often happens after switching providers and forgetting to delete the old records.
• An MX pointing at an IP address. MX records must point at a hostname, not a number.

See MX records explained if priorities (the numbers next to each record) are confusing.

Step 3: Check your SPF record

1. Open the SPF रिकॉर्ड चेकर and enter your domain.
2. Look for a single record that starts with v=spf1.

A typical record looks like this:

v=spf1 include:_spf.google.com include:mailer.example.net ~all

Read it left to right. Each include: authorizes a sending service. The ending matters: ~all (soft fail) tells receivers to treat other senders as suspicious, and -all (hard fail) tells them to reject. Many small businesses start with ~all.

Check for these problems:

• Two or more SPF records. A domain must have only one SPF record. Two separate v=spf1 entries cause a permanent error. Merge them into one.
• A sender missing. If your newsletter or billing tool is not covered, add the include: value that tool documents.
• Too many lookups. SPF allows at most 10 DNS lookups while evaluating. Each include: can use several. Going over means failure. The fix is in fix SPF "too many DNS lookups".
• A leftover provider. An include: for a service you stopped using is not dangerous by itself, but it uses up lookups and widens who can send as you. Remove it.

If you need to build a record from scratch, the SPF and DMARC Generator helps assemble one.

Step 4: Check DKIM

DKIM is the trickiest to check by hand because each sending service uses its own "selector," a label that decides where the key is published. The public key lives at a name like selector._domainkey.example.com.

Without knowing your selector, the easiest approach is to let a tool check common ones. The Email DNS Checker tests your domain's mail-related records together. If it cannot find a key, do not panic: the selector may simply be unusual.

To find out for certain:

1. Send yourself an email from each service (mailbox, website form, newsletter tool) to a Gmail address.
2. In Gmail, open the message, click the three dots, and choose Show original.
3. Look for the lines SPF, DKIM and DMARC near the top. You want PASS beside each.
4. Find the DKIM-Signature header and note the s= value. That is the selector, and d= is the signing domain.

If DKIM says FAIL or is missing, the service was never set up to sign with your domain. Each provider has a "verify domain" or "authenticate domain" page that gives you the exact record to add. See DKIM setup and troubleshooting.

Step 5: Check DMARC

1. Look up the TXT record at _dmarc.yourdomain.com. The Email DNS Checker does this for you.
2. A starter record looks like:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

p=none means "monitor only." It is the right place to start because nothing is blocked while you learn which senders fail. Later, you move to quarantine and then reject. The safe sequence is covered in DMARC rollout from none to reject.

If you have no DMARC record, add one with p=none and a reporting address you actually read. Some large mailbox providers have also published requirements for bulk senders; check current Google and Yahoo sender guidelines if you send newsletters in volume.

Step 6: Send a real test

Records can look right and mail can still go to spam. A test from your real sending address catches problems that record checks do not.

1. Run the ईमेल डिलीवरेबिलिटी टेस्ट and send the message it asks for.
2. Review the results for authentication, content and blocklist problems.
3. Check whether your domain or sending IP is listed with the Blacklist Checker. If it is, follow email blacklist removal.

If messages still land in spam after everything passes, read why email goes to spam and how to fix it.

Step 7: Save a record of the answers

Create a small note with your domain, your provider, the expected MX values, your SPF record, the DKIM selectors, and the DMARC record. Next time someone changes your DNS or you add a new tool, you can compare against it in minutes. Recheck whenever you add a new sending service, change email providers, or move your website.

When to call your host or developer

• Your DNS is managed by someone else and you do not have login access.
• You have two SPF records or exceed the 10 lookup limit and are not sure which services to remove.
• Mail from your website (contact forms, order emails) fails while your normal mailbox works. A developer may need to configure authenticated SMTP rather than the server's default mail function.
• Your sending IP is blocklisted and it is a shared server. Your host usually has to act.
• You plan to move DMARC to reject and are unsure whether every sender is aligned.

अगले कदम

• Email DNS Checker to test all your records together
• MX लुकअप to confirm where your mail is delivered
• SPF, DKIM and DMARC complete guide
• Transactional email DNS checklist
• Website owner monthly health checklist

सामान्य प्रश्न

Do I really need DMARC for a small business?

It is strongly recommended. A p=none record costs nothing, gives you reports, and helps stop others from easily spoofing your domain once you tighten the policy later.

Why do I get PASS in some tests and FAIL in others?

Different senders use different servers and signing keys. Your mailbox may be set up correctly while your newsletter tool or website is not. Test each sender separately.

Can I have more than one SPF record?

No. A domain should have exactly one SPF record. If you need several services, combine their include: entries into a single record.

How long until my fixes take effect?

Usually minutes to a few hours, depending on the record's TTL setting. Old values can be cached until the TTL expires.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.