Three DNS records decide whether your emails reach the inbox or the spam folder — and whether someone can send fake emails in your company's name. Check yours below, then fix them with this guide.
SPF, DKIM and DMARC are DNS records that prove your emails really come from your company. SPF lists who may send for your domain, DKIM signs each email, and DMARC tells receivers what to do with fakes. Every Google Workspace domain should have all three — without them, legitimate emails are more likely to land in spam.
Enter your company domain. We look up its public MX, SPF, DKIM and DMARC records in seconds — nothing is stored.
SPF says which servers may send your email, DKIM adds a tamper-proof signature to each message, and DMARC ties them together with a policy and reports. Together they stop spoofing and tell Gmail, Outlook and Yahoo your emails are genuine.
| Record | What it does | In plain words | Where it lives |
|---|---|---|---|
| SPF | Lists the servers allowed to send email for your domain | The guest list at the door | TXT on @ |
| DKIM | Adds a digital signature to every email you send | A wax seal on the envelope | TXT on google._domainkey |
| DMARC | Tells receivers what to do if SPF/DKIM fail, and sends you reports | The house rules for imposters | TXT on _dmarc |
Use one TXT record on your root domain: v=spf1 include:_spf.google.com ~all. If other services send email for you — such as a newsletter tool or your website — add their include to the same record. Never publish two separate SPF records.
Generate a 2048-bit DKIM key in the Google Admin console, publish it as a TXT record at google._domainkey, then click Start authentication. Gmail then signs every outgoing email from your domain.
Start with p=none and a reporting address so you can see who sends email as your domain without blocking anything. After a few weeks of clean reports, move to p=quarantine, and finally p=reject for full protection.
Since February 2024, Gmail and Yahoo require bulk senders — over 5,000 messages a day to Gmail — to have SPF, DKIM and DMARC, and all senders need at least SPF or DKIM. Missing records mean more emails rejected or sent to spam, and easier impersonation of your company.
No. A domain must have only one SPF record. Merge all senders into a single record, for example v=spf1 include:_spf.google.com include:servers.mcsv.net ~all.
Usually minutes to a few hours, and up to 48 hours in some cases. Lowering the TTL before you make changes helps them spread faster.
It can if some of your senders aren't covered by SPF or DKIM. That's why you start with p=none, read the reports, fix any gaps, and only then move to quarantine and reject.
Yes. It only reads public DNS records for the domain you enter and doesn't store anything. You can run it as often as you like.
Tell us your team size and current email. We'll recommend a plan and send a clear quotation — usually the same business day.