How to check SPF, DKIM and DMARC records for your domain

To check SPF, DKIM and DMARC, send yourself a test email and read its Authentication-Results line, then look up the three DNS records with a free checker. Each should say "pass". A domain needs exactly one SPF record, a DKIM key published under the name its mail server uses, and a DMARC record at _dmarc. If one is missing, add it at your DNS host.

What does each record look like?

All three are TXT records in your domain's DNS.

The "selector" in the DKIM name is a label your email provider chooses. Google Workspace uses "google", for example. Other providers use their own word, so you need to know it before you can look the key up.

How do I test it with one email?

This is the quickest check, and it shows what the receiving server really saw.

1. Send an email from your company address to a free Gmail address.
2. Open it in Gmail, click the three dots next to Reply, then Show original.
3. At the top, Gmail lists SPF, DKIM and DMARC with a result for each. You want PASS on all three.
4. In the same header, find the DKIM-Signature line. The value after "s=" is your DKIM selector.

In Outlook, open the message, go to File, then Properties, and look for Authentication-Results in the internet headers box.

How do I look up the records themselves?

Use a free DNS checker such as Google Admin Toolbox Check MX. Enter your domain and it reports whether SPF and DMARC are found and whether they look right. For DKIM, look up the TXT record at selector._domainkey followed by your domain, using the selector from your test email.

If you are comfortable with a command prompt, nslookup gives the same answer. On Windows, type nslookup -type=txt _dmarc.yourdomain.com.my and press Enter.

What mistakes are most common?

These are the ones we meet in support week after week:

• Two SPF records. Someone adds a new email service and creates a second v=spf1 line instead of editing the first. Microsoft and Google both say a domain may have only one, and two make SPF fail outright. Merge them into one line.
• Too many lookups. Each include: in SPF costs at least one DNS lookup, and SPF fails above 10. A record that lists a newsletter tool, an accounting system, a booking system and two mail providers can go over the limit.
• A forgotten sender. Your website contact form, online shop or billing system sends mail in your name but is missing from SPF and does not sign with DKIM.
• DKIM switched on at the provider but the key never added to DNS, or added under the wrong name. Some DNS panels add your domain to the end by themselves, so typing the full name gives you google._domainkey.yourdomain.com.my.yourdomain.com.my.
• DMARC with a typo. The record must start with v=DMARC1 and then p=, in that order. Google and Microsoft both suggest starting with p=none and moving to quarantine or reject once all your real mail passes.

What to do

1. Run the one-email test above today and note which of the three fail.
2. List every system that sends email as your domain: your mailboxes, website, shop, newsletter and accounting tools.
3. Ask each provider for the exact SPF include and DKIM key they need, then add them to your single SPF line and your DNS.
4. Add a DMARC record with p=none and a report address if you do not have one.
5. Wait a few hours for DNS to update, then repeat the test email.

If emails to Hotmail or Outlook.com are bouncing, our earlier post on Outlook.com rejecting your email explains the error codes Microsoft sends.

How SyncTech can help

If your records do not pass and you would rather not edit DNS yourself, our email delivery troubleshooting team can check the SPF, DKIM and DMARC records for your domain and tell you the exact fix.

Source and credit

We are sharing guidance from Google and Microsoft. This guide is written by Synctech in our own words.

• Set up SPF, Google Workspace Admin Help: https://support.google.com/a/answer/33786?hl=en
• About SPF records, Google Workspace Admin Help: https://support.google.com/a/answer/10683907?hl=en
• Set up DKIM, Google Workspace Admin Help: https://support.google.com/a/answer/174124?hl=en
• Set up DMARC, Google Workspace Admin Help: https://support.google.com/a/answer/2466580?hl=en
• Set up SPF to identify valid email sources for your Microsoft 365 domain, Microsoft Learn: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure
• Set up DMARC to validate email in Microsoft 365, Microsoft Learn: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure
• Check MX, Google Admin Toolbox: https://toolbox.googleapps.com/apps/checkmx/

Retrieved 15 November 2026. Google, Gmail and Google Workspace are trademarks of Google LLC. Microsoft and Outlook are trademarks of Microsoft Corporation. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.