Why email setup matters
Gmail, Outlook and Yahoo decide whether to deliver, spam-folder or reject a message partly by checking DNS records of the sender’s domain. A domain without SPF, DKIM and DMARC looks untrustworthy, so its genuine mail lands in spam, and anyone can send fake email that seems to come from it.
What is checked
- MX: whether the domain can receive email, and which servers handle it.
- SPF: that there is exactly one record, that it ends with ~all or -all, and that it stays within the 10 DNS lookups the standard allows — counting every nested include.
- DKIM: whether signing keys exist under the common selectors used by Google Workspace, Microsoft 365, Zoho, Mailchimp and others.
- DMARC: the policy (none, quarantine or reject) and whether reports are requested.
Fixing what you find
- Missing SPF: make one with the SPF Record Generator.
- No DKIM: turn on DKIM signing in your mail provider’s admin console and add the record it gives you.
- Missing DMARC: start with p=none using the DMARC Record Generator, then tighten it once reports look clean.
Frequently asked questions
Why are my emails going to spam?
Often because SPF, DKIM or DMARC is missing or broken. Check your domain here; content, sending volume and your server’s reputation also play a part.
What does “too many DNS lookups” mean for SPF?
Each include and each a or mx term costs a lookup, and includes can contain more. Over 10 in total, receivers treat SPF as failed. Remove services you no longer use.
Why does it say DKIM was not found when I have it?
DKIM keys live under a selector name chosen by your provider. If yours is not one of the common ones, find it in an email header (s= in the DKIM-Signature) and enter it.