---
title: "A checklist for SPF, DKIM and DMARC records"
url: "https://lookvalid.com/blog/security/spf-dkim-dmarc-checklist.md"
canonical_url: "https://lookvalid.com/blog/security/spf-dkim-dmarc-checklist"
last_updated: "2026-10-22"
type: "conceptual"
summary: "Check the three email authentication records in minutes, with the RFC limits that trip people up and a request that reads SPF and DMARC for you."
related: ["https://lookvalid.com/products/email-domain-check.md", "https://lookvalid.com/tools/dmarc-checker.md", "https://lookvalid.com/glossary/spf.md", "https://lookvalid.com/glossary/dkim.md", "https://lookvalid.com/glossary/dmarc.md", "https://lookvalid.com/docs/quickstart.md"]
---

# A checklist for SPF, DKIM and DMARC records

Check the three email authentication records in minutes, with the RFC limits that trip people up and a request that reads SPF and DMARC for you.

SPF, DKIM and DMARC are three DNS-based records that let a receiving server judge whether mail really came from the domain it claims. Most failures come from a handful of rules that are easy to break and hard to notice. This checklist walks through them in the order we would check a domain, and shows which parts of the job a LookValid request covers.

## What each record does

SPF lists which hosts may send mail for a domain, DKIM lets a sender sign each message with a key published in DNS, and DMARC tells receivers what to do when neither of those checks lines up with the visible From domain. All three are ordinary TXT records, so you can read them with any DNS tool.

Where each record lives and what to look for

| Record | DNS name | Starts with | Look for |
| --- | --- | --- | --- |
| SPF | the domain itself | `v=spf1` | One record, an `all` term at the end |
| DKIM | `selector._domainkey.domain` | `v=DKIM1` | A non-empty `p=` public key |
| DMARC | `_dmarc.domain` | `v=DMARC1` | A `p=` policy, ideally with `rua=` reports |

## SPF: two limits that cause silent failures

A domain must not publish more than one SPF record. When a receiver finds more than one record that begins with `v=spf1`, the check returns a permanent error rather than picking one [1]. The usual cause is a second record added by a new mail vendor while the old one is still in place. Merge them into a single record.

The second limit is on DNS lookups. An SPF evaluation may trigger at most 10 terms that cause DNS queries, and exceeding that also returns a permanent error [1]. The terms that count are `include`, `a`, `mx`, `ptr` and `exists`, plus the `redirect` modifier; `ip4`, `ip6` and `all` do not count [1]. Every vendor you add with an `include:` spends part of that budget, and a vendor's own record can spend more behind it.

- Count the `include`, `a`, `mx`, `exists` and `redirect` terms, including those inside included records.
- End the record with `-all` or `~all` once you are sure every legitimate sender is listed.
- Prefer `ip4` and `ip6` ranges for hosts you control, since they cost no lookups.

## DKIM: find the selector first

A DKIM key is published as a TXT record under a `_domainkey` subdomain, named by the selector the signer chose [2]. The selector appears in the `s=` tag of the `DKIM-Signature` header on a real message, and the signing domain appears in `d=` [2]. You cannot guess it from the domain alone, so open a sent message and read the header.

In the key record, `v=` if present must be `DKIM1` and come first, `k=` defaults to `rsa`, and `p=` holds the base64 public key. An empty `p=` means the key has been revoked [2]. If a selector query returns a record with an empty `p=`, mail signed with that selector will fail.

Read a DKIM key for a known selector

```bash
dig +short TXT selector1._domainkey.example.com
```

## DMARC: policy, scope and reports

The DMARC record is a TXT record at `_dmarc` under the domain, and its `p=` tag is required [3]. The policy values are `none` (no requested action), `quarantine` (treat failing mail as suspicious) and `reject` (refuse failing mail) [3]. If `sp=` is absent, the `p=` policy applies to subdomains too, and `pct=` defaults to 100 [3].

The `v=DMARC1` tag must come first in the record [3]. As with SPF, publish one record: if a receiver finds several, DMARC processing is not applied to the message [3]. Start at `p=none` with an `rua=` address so aggregate reports show you every sender before you tighten to `quarantine` and then `reject`.

## Check SPF and DMARC with one request

The `email-domain-check` product reads the MX, SPF and DMARC records for the domain behind an address and reports what it found, including `multiple_spf_records` and `no_dmarc_record` issues. Two limits to know: it follows `redirect=` in SPF but does not expand `include:` terms or count lookups, and it does not check DKIM, because the selector is not discoverable from DNS. It also never contacts a mail server.

Check the records for a domain

```bash
curl -X POST https://YOUR_API_HOST/v1/email-domain-check \
  -H "Authorization: Bearer $LOOKVALID_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com"}'
```

Excerpt of a captured example response for example.com

```json
{
  "spf": { "record": "v=spf1 -all", "record_count": 1, "policy": "-all", "valid": true, "issues": [] },
  "dmarc": { "record": "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s", "policy": "reject", "valid": true, "issues": [] }
}
```

Read the `issues` arrays first: they name the problem in a form you can branch on. To run the same check across a list of domains, see the [quickstart](https://lookvalid.com/docs/quickstart.md) or try the free [DMARC checker](https://lookvalid.com/tools/dmarc-checker.md).

1. Count SPF records: exactly one.
2. Count SPF lookups against the limit of 10.
3. Find a DKIM selector in a sent message header and query it.
4. Publish DMARC at `p=none` with `rua=`, then tighten.

The [email domain check](https://lookvalid.com/products/email-domain-check.md) product page has the full request and response reference.

## Sources

1. [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208.html), read 2026-10-19
2. [RFC 6376: DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376.html), read 2026-10-19
3. [RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc7489.html), read 2026-10-19

By LookValid engineering. Published 2026-10-19, updated 2026-10-19.

## Related

- [Email Domain Check API](https://lookvalid.com/products/email-domain-check.md)
- [Free DMARC checker](https://lookvalid.com/tools/dmarc-checker.md)
- [What is SPF (Sender Policy Framework)?](https://lookvalid.com/glossary/spf.md)
- [What is DKIM (DomainKeys Identified Mail)?](https://lookvalid.com/glossary/dkim.md)
- [What is DMARC?](https://lookvalid.com/glossary/dmarc.md)
- [Quickstart](https://lookvalid.com/docs/quickstart.md)