Domain DNS & Authentication Audit
Audit MX, SPF, DMARC, DKIM, and BIMI records for your email domain.
Recommended DNS Authentication Stack
DNS TXT record declaring which IP addresses are authorized to send email on behalf of your domain. Always conclude with ~all or -all.
Cryptographic public key in DNS matching a private key used by your mail server to digitally sign messages, proving they were not altered in transit.
Instructs receiving mail servers what action to take if SPF or DKIM fail (none, quarantine, or reject) and specifies reporting addresses.
Frequently Asked Questions
Why do Google and Yahoo require DMARC for email senders?
Starting in 2024, Google and Yahoo enforce strict authentication requirements to eliminate spam and phishing impersonation. Senders without valid SPF, DKIM, and at least a DMARC monitoring policy (p=none) face delivery delays or complete rejection.
Can I have more than one SPF TXT record on my domain?
No. RFC 7208 strictly prohibits having more than one SPF record on a single domain. If multiple SPF records are detected, email receivers will return a PermError, causing authentication to fail. Always merge multiple include mechanisms into a single record.
What is the difference between ~all and -all in SPF?
The '~all' mechanism indicates a Softfail, meaning unlisted servers are questionable but should still be accepted (often routed to spam). The '-all' mechanism indicates a strict Fail, instructing receiving mail servers to reject messages from unauthorized IP addresses outright.