Emails landing in spam? Check SPF, DKIM and DMARC

Tools

Terminal (dig), Gmail

Price

Free

Time

10 min

Level

Terminal, beginner

One sentence each: SPF lists the servers allowed to send email for your domain. DKIM adds a signature to every email that the recipient can verify. DMARC says what to do with an email that fails those two tests, and sends you reports. Google asks every sender for at least SPF or DKIM, and all three from anyone sending more than 5,000 messages a day to Gmail.

The simplest test, no terminal

1. Send yourself an email to a Gmail addressFrom your work address (you@your-company.com) to a Gmail address you can open.
2. Show originalIn Gmail on a computer, open the email, click the three dots next to “Reply”, then “Show original”. At the top, three lines for SPF, DKIM and DMARC say PASS or FAIL.

Read the settings from the Terminal

The dig command is already installed on a Mac. It reads DNS records, the public entries attached to your domain. Replace your-company.com with your own domain.

1. SPFLook for a line starting with v=spf1. There should be only one.

   TerminalCopy

   dig +short TXT your-company.com

2. DMARCThe answer should start with v=DMARC1. If nothing comes back, you have no DMARC.

   TerminalCopy

   dig +short TXT _dmarc.your-company.com

3. DKIMYou need the “selector”, the short name of the key. On Google Workspace it is google by default; on Microsoft 365, selector1 or selector2. Otherwise, it appears in “Show original”, after s= in the DKIM-Signature line.

   TerminalCopy

   dig +short TXT google._domainkey.your-company.com

On Windows, the equivalent command is nslookup -type=TXT _dmarc.your-company.com. Google also offers an online tool, Check MX, which checks a domain's mail settings.

If DMARC is missing

Google advises starting in monitoring mode: emails are delivered as usual, and you receive reports on who sends in your name. At your domain host, you add a TXT record named _dmarc with a value like this (replace the report address, ideally with a dedicated inbox):

v=DMARC1; p=none; rua=mailto:dmarc@your-company.com

Once all your legitimate senders pass (email marketing tool, invoicing, CRM), you tighten step by step to p=quarantine, then p=reject.

Careful. A wrong DNS record can block your own emails. Google recommends waiting 48 hours after setting up SPF or DKIM before adding DMARC, and only moving to reject after reading the reports. Only check and change domains you own.

Sources

• Google, email sender guidelines
• Google Workspace, set up DMARC
• Google Workspace, set up DKIM (default selector)
• Microsoft, DKIM for a custom domain
• Gmail, view the full header of an email

Do your follow-ups, quotes and newsletters go out from an automated tool? I check these settings on every automation that sends email.