How to Test Email Authentication (SPF, DKIM, DMARC) — Step by Step

Why Testing Email Authentication Matters

You can configure SPF, DKIM, and DMARC records perfectly in DNS — and still have them fail silently because of a sending service misconfiguration, a missing include, or an alignment issue. Testing is not optional. It's the only way to confirm your configuration is working as intended.

This guide covers three levels of testing: quick DNS lookups, sending a test email and analyzing headers, and using dedicated verification tools.

Step 1: Check Your DNS Records

Before sending any test email, verify that your records exist and are syntactically correct.

SPF Check

dig TXT yourdomain.com | grep spf

What to look for:

• Record starts with v=spf1
• Contains all your sending services (include:sendgrid.net, etc.)
• Has a catch-all mechanism (~all or -all) at the end
• No more than 10 DNS lookups

Use our SPF Checker for a complete analysis including lookup count.

DKIM Check

DKIM records are stored at selector._domainkey.yourdomain.com. You need to know your DKIM selector (find it in your mail service's configuration).

dig TXT google._domainkey.yourdomain.com

What to look for:

• Record starts with v=DKIM1
• Contains a p= value (the public key)
• Key type is RSA with 2048-bit minimum (k=rsa)

Use our DKIM Checker to verify any selector for any domain.

DMARC Check

dig TXT _dmarc.yourdomain.com

What to look for:

• Record starts with v=DMARC1
• Has a p= policy (none, quarantine, or reject)
• Has a rua= address for receiving reports

Use our DMARC Checker for policy analysis.

Step 2: Send a Test Email and Analyze Headers

DNS records existing is necessary but not sufficient. You must also confirm that your mail server is actually signing messages with DKIM and that alignment passes.

Method A: Send to Gmail and check headers

1. Send an email from your domain to a Gmail address
2. In Gmail, open the message
3. Click the three-dot menu → "Show original"
4. Look for these lines in the raw headers:

Authentication-Results: mx.google.com;
   dkim=pass header.i=@yourdomain.com header.s=selector header.b=xxxxx;
   spf=pass (google.com: domain of noreply@yourdomain.com designates 203.0.113.5 as permitted sender) smtp.mailfrom=noreply@yourdomain.com;
   dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=yourdomain.com

All three should show pass. If any shows fail or softfail, note the reason and debug accordingly.

Method B: Use our Email Header Analyzer

1. Send a test email to any address
2. Copy the full email headers
3. Paste them into our Email Header Analyzer
4. Get a structured breakdown of SPF, DKIM, and DMARC results

Step 3: Automated Authentication Testing

For systematic testing, especially before major send campaigns:

FreeMailTools Authentication Score

Our Authentication Score tool checks SPF, DKIM, and DMARC for any domain simultaneously and returns a combined score with recommendations.

Mail-Tester.com

1. Open mail-tester.com — it gives you a unique address
2. Send a real email to that address from your domain
3. Click "Check your score"
4. See SPF, DKIM, DMARC results, plus spam score

Free users get 3 tests per day. Use these strategically.

Google Admin Toolbox — Check MX

Google's Admin Toolbox checks your MX, SPF, and DKIM setup from Google's perspective.

Interpreting Common Failures

dkim=fail (signature did not verify)

The DKIM signature in the email doesn't match the public key in DNS. Common causes:

• Private key rotation without updating the public key in DNS
• Message body modified after signing (by a mailing list or forwarding service)
• Wrong selector configured in the mail server

spf=fail with a softfail or neutral

Your SPF record doesn't include the sending server's IP.

• Check which IP your mail server uses to connect to the internet
• Add that IP or an include: for the sending service to your SPF record

dmarc=fail despite SPF and DKIM passing

This is usually an alignment issue. The domain in the From: header doesn't match the domain that passed SPF or DKIM.

• If using a third-party sender, ensure they sign with DKIM using your domain, not theirs

dmarc=fail with dkim=permerror

Your DKIM key length is too short (512-bit keys are rejected by many receivers). Upgrade to 2048-bit minimum. Use our DKIM Key Generator to create new keys.

Testing Checklist

Before going live with a new domain or email configuration:

• SPF record exists and is syntactically valid
• SPF has fewer than 10 DNS lookups
• SPF includes all sending services and IPs
• DKIM record exists for each selector in use
• DKIM key is 2048-bit minimum
• DMARC record exists with at minimum p=none; rua=
• Test email to Gmail shows dkim=pass, spf=pass, dmarc=pass
• Mail-Tester score is 8/10 or higher
• PTR record matches mail server hostname

Tools Used in This Guide

• SPF Checker
• DKIM Checker
• DMARC Checker
• Email Header Analyzer
• Authentication Score
• DKIM Key Generator
• Domain Health Checker