Email domain health check: SPF, DKIM and DMARC

SPF is one TXT record at your domain, starting v=spf1, that lists the servers allowed to send mail as you. Every include, a, mx, ptr, exists and redirect in it makes the receiver look up another DNS name, and includes can hold includes of their own. RFC 7208 caps the total at 10, and a record that needs more is a permanent error, which receivers treat as a failure.^[1]

This check walks every include the way a receiver does and counts them. It also flags two SPF records on one domain (a permanent error too), more than two includes that point at names that answer nothing (the void lookup limit), and a record ending in +all or ?all, which lets any server send as you.^[1] When your mail runs on Google, Microsoft, Zoho or Fastmail, it also checks that SPF lists that provider.

The usual fix for too many lookups is to remove services you no longer send from. Agencies collect them: an old newsletter tool, a CRM you left, a help desk that sends as you.

DKIM signs each email with a private key. The public half sits in DNS at a name like selector._domainkey.yourdomain.com, where the selector is a label your provider picks, so a checker has to guess it unless you tell it.^[2] This check tries the selectors Google Workspace, Microsoft 365, Zoho and Fastmail use, a few common ones, and any selector you type in the DKIM selector box.

A record with an empty p= means the key was revoked.^[2] A published key also does not prove your provider signs with it. To be sure, send yourself a test email and look in its headers for dkim=pass next to your own domain.

DMARC is a TXT record at _dmarc.yourdomain.com that tells receivers what to do with mail that fails SPF and DKIM for your domain, and where to send reports. Gmail requires senders of 5,000 or more messages a day to its users to publish one, and says the policy can be none.^[3]

When a subdomain has no record of its own, the check walks up the name, so mail.acme.co.uk finds the record at _dmarc.acme.co.uk. That is the DNS tree walk of RFC 9989, which replaced the public suffix list as the way to find a domain's DMARC record.^[4] Moving from p=none to p=quarantine or p=reject is a later step for once the reports show all your real mail passing.

• MX: who receives mail for the domain. With no MX record, replies to your campaign have nowhere to go.
• The address: a gmail.com or outlook.com address is fine for a few emails, not for campaigns, because you cannot publish SPF, DKIM or DMARC on a domain you do not own. Microsoft limits mail from the default onmicrosoft.com addresses to 100 external recipients a day for the whole organisation.^[5]
• Domain age: read from the registry over RDAP. Under 30 days old reads as weak, because mail providers distrust brand new domains, and Gmail asks senders to start with a low volume and increase it slowly.^[3] Some country registries do not publish registration dates, so the age can say unknown.

Sealrep does not start a campaign from a domain whose SPF or DKIM is missing, or whose SPF is in permanent error. That is the line under your result. The other chips are warnings: a campaign can start, and they stay on the mailbox page until you fix them. A lookup that timed out never blocks a campaign, so the line waits until every DNS check has answered.

Fixing DNS happens where your domain's DNS is hosted, usually the company you bought the domain from. Sealrep checks the records and shows the exact one to add; it does not change your DNS, and it does not sell or warm mailboxes. It sends from mailboxes you already own: any mailbox over SMTP and IMAP today, with Google and Microsoft sign-in coming soon.