How to verify SPF, DKIM, and DMARC are set up correctly
Email authentication is the foundation of strong deliverability. If you’re sending emails—whether it’s marketing campaigns, transactional messages, or newsletters—you need to ensure that your messages are protected and verified using SPF, DKIM, and DMARC. These protocols not only protect your domain from spoofing and phishing but also play a significant role in making sure your emails land in the inbox, not the spam folder.
Thankfully, verifying whether these records are in place and functioning correctly is a relatively easy process. In this guide, we’ll walk you through a quick method using Gmail and help you interpret the results. Whether you’re just getting started or troubleshooting issues, this step-by-step guide is for you.
What Are SPF, DKIM, and DMARC?
Before diving into the process, let’s briefly explain what each of these terms means:
SPF (Sender Policy Framework)
SPF allows domain owners to specify which IP addresses are authorized to send emails on their behalf. If an unauthorized server tries to send an email claiming to be from your domain, SPF can catch it.
DKIM (DomainKeys Identified Mail)
DKIM uses cryptographic signatures to ensure that an email has not been tampered with during transit. It helps verify that the email content is legitimate and unchanged from when it was originally sent.
DMARC (Domain-based Message Authentication, Reporting & Conformance)
DMARC builds on SPF and DKIM and adds reporting capabilities. It lets domain owners tell email providers how to handle failed authentication attempts (e.g., quarantine or reject the message).
Why These Records Matter
SPF, DKIM, and DMARC are not just best practices—they are essential to secure your brand and improve your sender reputation. Without them, your emails may:
- Get flagged as spam
- Be rejected entirely
- Be vulnerable to spoofing or phishing attacks
Email service providers like Gmail, Outlook, and Yahoo heavily rely on these protocols when making deliverability decisions.
How to Check If Authentication Is Passing in Gmail
If you use Gmail (and let’s be honest—most of us do), there’s a built-in way to verify whether your SPF, DKIM, and DMARC settings are working correctly.
Step-by-Step: Checking Email Authentication in Gmail
- Send an Email Start by sending an email to your Gmail account from the domain you want to check. Make sure you’re using the same infrastructure and sending tools you normally use.
- Open the Email Go to your Gmail inbox and open the email you just sent.
- Open the “Show Original” View In the top right corner of the message, you’ll see a small icon with three vertical dots (often referred to as the “meatball menu”). Click on it and select “Show original.”
- View the Authentication Results A new tab will open showing the full email header information. Right at the top, Gmail gives you a helpful table with the results of SPF, DKIM, and DMARC authentication. Here’s what you’re looking for:
- SPF: PASS
- DKIM: PASS
- DMARC: PASS
- If all three are marked as “PASS,” you’re in great shape!
What to Do If You See FAIL or NEUTRAL
If any of the protocols show a “FAIL” or “NEUTRAL” status, it means something is misconfigured. Here’s how to troubleshoot:
SPF Failures
- Check that your SPF record includes all the sending IP addresses or services you use (e.g., Mailchimp, SendGrid, your CRM).
- Ensure your SPF record is not too long (the 10 DNS lookup limit applies).
- Use a tool like MXToolbox SPF Lookup to inspect your record.
DKIM Failures
- Make sure DKIM is enabled in your email platform or server.
- Check that the DKIM public key is published correctly in your DNS settings.
- Look out for formatting issues or multiple DKIM selectors causing conflicts.
DMARC Failures
- Ensure you have a DMARC policy record in your DNS (it usually starts with v=DMARC1).
- Verify that both SPF and DKIM are aligned (i.e., the domain in the “From” address matches the authenticated domains).
If you’re stuck or unsure about how to fix a failed result, it’s a smart move to consult with a deliverability expert or email service provider.
Bonus Tip: Use MXToolbox to Learn More
For those who want to dive deeper into headers or need help interpreting them, MXToolbox offers a great guide. You can paste in your full email header, and their tools will break down what’s going on behind the scenes.
They also offer additional lookups for SPF, DKIM, and DMARC records, helping you spot errors, formatting issues, or missing records.
Email Authentication: A Quick Win for Better Deliverability
Implementing and verifying SPF, DKIM, and DMARC is one of the easier deliverability fixes you can make—but it has a significant impact. With just a few minutes of work, you can greatly reduce the chances of your emails getting flagged or rejected.
And more importantly, you’re protecting your domain and brand reputation from bad actors who might otherwise spoof your identity.
Final Thoughts
Good email deliverability isn’t magic—it’s the result of strong practices and ongoing monitoring. Verifying that SPF, DKIM, and DMARC are properly configured is a key step in building that foundation.
So go ahead, send yourself that test email, open up Gmail’s “Show Original” view, and check the status. If you see “PASS” across the board, take a moment to pat yourself on the back. If not, dig into your DNS settings and sort it out—or partner with a deliverability expert who can help.
At Inboxroad, we’re here to help senders succeed with high inbox placement, reliable infrastructure, and expert support. If you’re experiencing issues or need help getting your domain authentication in order, reach out to our team. We’ve got your back.
Need help with email authentication or want to optimize your sending infrastructure? Contact Inboxroad today and get expert guidance to boost your deliverability.
Daniel Garcia Bonilla is a seasoned Email Deliverability Consultant with experience helping businesses optimize their email campaigns for maximum engagement and ROI.
Remember you can create a free account including 1,000 emails per month to test our service.
Don’t hesitate to contact us at contact@inboxroad.com if you have any questions.
