SPF, DKIM & DMARC

The three records that stop spoofing

• SPF: a TXT record at the domain, starting v=spf1, listing the servers allowed to send its mail. It may trigger at most 10 DNS lookups (include, a, mx, ptr, exists, redirect); more than that is a permanent error and SPF fails for everyone. MtrXTools shows the lookup tree so you can see which include uses them up.
• DKIM: a cryptographic signature on each message. The public key lives at selector._domainkey.example.com. Selectors can't be listed, so MtrXTools tries the common ones (Google, Microsoft 365, Zoho, Mailjet and others) and any you add.
• DMARC: a TXT record at _dmarc.example.com that tells receivers what to do when a message fails: p=none (monitor), quarantine (spam folder) or reject. A message passes DMARC when SPF or DKIM passes for a domain that matches the visible From address.

How the grade works

Out of 100 points, the largest share goes to an enforced DMARC policy (reject 30, quarantine 22, none 5) and a valid DKIM key (25). The rest covers a valid SPF record within the lookup limit and ending in -all or ~all, a DMARC record, and a rua address for reports. A+ needs 95.

Getting to p=reject safely

• Publish v=DMARC1; p=none; rua=mailto:dmarc@example.com and collect reports for two to four weeks.
• Open the reports in the DMARC report analyser and fix every legitimate sender that fails: add it to SPF, or turn on DKIM signing in that service.
• Move to p=quarantine, watch for a week or two, then p=reject.

The extras

MTA-STS and TLS-RPT make other servers deliver to you over verified TLS and report failures. BIMI shows your logo in supporting inboxes once DMARC is at quarantine or reject.

Example records

• SPF for Google Workspace plus one other service: v=spf1 include:_spf.google.com include:servers.mcsv.net -all
• DMARC while monitoring: v=DMARC1; p=none; rua=mailto:dmarc@example.com
• DMARC fully enforced, subdomains included: v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com
• A domain that never sends mail: SPF v=spf1 -all and DMARC v=DMARC1; p=reject.

Questions

Do Gmail and Microsoft require this?

Yes for bulk senders. Since 2024 Gmail and Yahoo require SPF, DKIM and a DMARC record from anyone sending more than 5,000 messages a day, and Outlook.com added the same rule in May 2025. Smaller senders get junked or rejected far less often with all three in place.

Why can't MtrXTools find my DKIM key?

Your provider uses a selector that isn't on the common list. Open a message you sent, find the s= value in its DKIM-Signature header (the Email header analyser shows it), and enter it in the DKIM selectors box.

How do I fix "too many DNS lookups" in SPF?

Remove includes for services you no longer use, replace an include with the service's IP ranges where it publishes stable ones, or move some senders to a subdomain with its own SPF record.

My domain doesn't send email. Do I need any of this?

Yes, because spammers spoof unused domains too. Publish v=spf1 -all, a DMARC record with p=reject, and optionally a null MX record (0 .) to say the domain accepts no mail.