ON. WebMeter

SPF, DKIM and DMARC check

Three DNS records play a big part in whether your emails reach the inbox, and they let receiving servers recognise and reject mail that someone else sends in your name.

Updated

What SPF, DKIM and DMARC are

  • SPF is a TXT record in DNS listing the servers allowed to send mail for your domain. A domain may have only one, and evaluating it may trigger no more than 10 DNS lookups in total, including those inside nested includes.
  • DKIM is a digital signature on every message. The public key sits in DNS under the name selector._domainkey.
  • DMARC (the _dmarc record) ties both to the From address and tells the recipient what to do with a message that fails the checks: nothing (p=none), send it to spam (p=quarantine) or reject it (p=reject). The rua address receives aggregate reports.

Why it matters for a small business

Without DMARC, anyone can send an email that appears to come from you: a fake invoice with changed bank details, or a link to a fraudulent page. Large providers have also tightened their rules. Since February 2024, Gmail and Yahoo require SPF or DKIM from all senders and, from bulk senders (for Gmail, over 5,000 messages a day), SPF, DKIM and DMARC, domain alignment and easy unsubscribing. Microsoft introduced similar rules for Outlook.com and Hotmail from May 2025 and rejects non-compliant bulk mail. So even a small business sending invoices or a newsletter risks its mail ending up in spam without the right records.

Common SPF, DKIM and DMARC mistakes

  • Two SPF records (for example after switching provider) — then neither is valid.
  • SPF ends with +all or ?all, so it forbids nothing, or exceeds the limit of 10 lookups through nested includes.
  • DMARC stays on p=none for years and nobody reads the reports; it protects only on paper.
  • A newsletter tool, online shop or accounting program sends mail in your name but is not in SPF and does not sign with DKIM.
  • A domain that doesn't use email at all has no protection. A null MX (MX 0 .), SPF v=spf1 -all and DMARC p=reject help.

What WebMeter checks, and what it doesn't

WebMeter reads the public DNS records of your organisational domain: SPF (missing, duplicated, weak all, more than 10 DNS lookups including nested includes, a reference to a domain without SPF), DMARC (missing, p=none, partial pct, reporting address), common DKIM selectors, MX records, and also MTA-STS, DANE and BIMI.

It sends no email and cannot see your actual outgoing mail. It may not find DKIM with a custom selector, so it marks it as not verified rather than missing. It does not test your mail server directly.

Check your website for free

Enter your domain to see the state of SPF, DKIM and DMARC, along with the other areas of your website.

Check website

Not sure what to make of the results? We offer a no-obligation consultation, just write to kontakt@webmeter.eu.

FAQ about SPF, DKIM and DMARC

Is SPF on its own enough?

No. SPF only protects the envelope address, which the recipient never sees. The From address is protected only by DMARC, which needs SPF or DKIM to pass with a matching domain. That is why Gmail, Yahoo and Microsoft require all three from bulk senders.

Why does WebMeter say “DKIM not verified” when I do have DKIM?

A DKIM key sits in DNS under a selector name chosen by your email provider, and there is no way to list every selector from DNS. WebMeter tries common selectors and those typical for your provider. If it doesn't find yours, that does not disprove DKIM; it just stays unverified.

What is a null MX?

An MX record with priority 0 and a dot instead of a server name (RFC 7505). It announces that the domain does not accept mail. It suits domains that don't use email, together with SPF v=spf1 -all and DMARC p=reject.