If your domain's emails are not arriving, are landing in spam, or someone is sending fake messages in your name, the cause is almost always in four DNS records: MX, SPF, DKIM and DMARC. Since 2024, Gmail and Yahoo have required these records from bulk senders, and in practice every provider now gives them weight.
MX: who receives your email
The MX record tells which server should receive messages sent to your domain. Without it, nobody can send email to you@yourdomain.com.
Example: 10 mx1.provider.com and 20 mx2.provider.com. The number is the priority: the lowest one is tried first, and the other serves as a backup.
Common mistakes: MX still pointing to the old host after a migration, or pointing to an IP instead of a name. The MX must always point to a name that has an A record.
SPF: who can send on your behalf
SPF is a TXT record that lists the servers allowed to send email for your domain. The receiving server checks whether the message came from one of those addresses.
Example: v=spf1 include:_spf.google.com include:website-server.com -all
include:authorizes a service's servers, such as Google Workspace or an email marketing platform.-allat the end says to reject anything not on the list.~allis softer and flags it as suspicious.
Common mistakes: having two SPF records (there can only be one; merge everything into a single line), forgetting to include the service that sends your website's or store's emails, and going over the limit of 10 include lookups.
DKIM: the digital signature
DKIM signs each message with a private key stored on the sending server. The matching public key is published in DNS, in a TXT record with a name like selector._domainkey.yourdomain.com. The recipient verifies the signature and gets assurance that the message was not altered and came from an authorized server.
You do not create the key by hand: your email service (Google Workspace, Microsoft 365, your hosting panel) generates the record and you just copy it into DNS. Each service that sends on your behalf has its own selector.
DMARC: the policy and the reports
DMARC ties it all together. It tells providers what to do when a message fails SPF and DKIM, and where to send reports. It lives in a TXT record named _dmarc.yourdomain.com.
A safe starting example: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
p=none: only monitors and sends reports. Start here.p=quarantine: sends failing messages to spam.p=reject: rejects failing messages. This is the strongest protection against anyone trying to impersonate your domain.
The recommended path is to start with none, follow the reports for a few weeks until you are sure all legitimate services pass, then move up to quarantine and later reject.
How to check your domain
- In the DNS lookup, type your domain and look at the MX and TXT records. SPF is the line that starts with
v=spf1. - To see DMARC, look up the name
_dmarc.yourdomain.comand find the TXT record that starts withv=DMARC1. - If your email goes out from your own server, also check the IP's reverse DNS and whether it is on any blacklist.
Summary
- MX: where your email arrives.
- SPF: who is allowed to send.
- DKIM: a signature that proves the origin.
- DMARC: what to do when something fails, plus reports.
With all four in place, your emails are far more likely to reach the inbox, and it becomes much harder for anyone to impersonate your domain.