Outbound Wiki

Email authentication testing

How to verify SPF, DKIM and DMARC records and inspect authentication results on delivered messages.

Authentication testing should end with a delivered message you can inspect, alongside the DNS records that authorize and sign mail. A record lookup shows what the domain publishes, while the message header shows what a receiving service evaluated. This distinction catches the failure a DNS check alone misses. SPF, DKIM and DMARC must pass before the first email is sent.1 Incorrect setup can leave messages quarantined as spam or undelivered.2 Run the checks in that order. Keep the header result and use it to decide whether you can send or need to fix the configuration.

Prepare the test

Start with the domains and sending paths you plan to use. Keep the provider's setup instructions beside you so the DNS values and verification actions match the system sending the message.

Check SPF, DKIM and DMARC configuration in current provider documentation before you edit DNS.3 Treat each sending path as a separate test. SPF or DKIM must pass for each source, and DMARC alignment must be confirmed from real headers.4

Check published DNS

Check whether the records exist and whether their syntax and values look right before you send a test message. Then use the delivered message to verify what the receiving service saw.

For SPF, use one of the many free internet tools to see whether SPF is already set up for the domain.5 After setting up the SPF record, verify that it works correctly.6

For DKIM, check whether the record is already set up with a free internet tool.7 Use the selector with a DKIM lookup service to check that the record has been applied.8

For DMARC, run a DMARC Record Check to verify that the record has the correct values and syntax.9 Move on when the published records match the provider's configuration and the checks return the expected result.

Send and inspect a delivered message

Send a test message to an external mailbox and inspect its message headers.10 Look for Authentication-Results.11 Receiving services use different header formats, so the wording can vary. The DKIM result should say something like dkim=pass or dkim=OK.12

Ask the header: "Did the signature pass, and which domain appears in d=?"13

For SPF, inspect the headers used during validation. The receiving server compares two headers during SPF validation,14 and the RFC5321.MailFrom/Return Path domain is one of them.15 Record the Return Path shown on the message so you can tell which sending path was tested.

Compare the header results with the compliance or authentication dashboard provided by your mailbox provider.16 If the message header and dashboard point to different outcomes, keep the delivered header with the test details and resolve the configuration before sending more mail.

Read the result

Read each result according to the job it performs so a passing record is not mistaken for a passing message.

SPF lets a domain list all the servers from which it sends email.17 A failed SPF result sends you back to the published authorization and the Return Path used by the test message.

DMARC tells mail servers whether to mark messages that fail DKIM or SPF as spam, deliver them anyway, or drop them.18 Read the DMARC result with the SPF and DKIM results from the same delivered message, then check whether the sending path and the authenticated domain align.

Use the result tied to the actual source that sent the message. A test from one provider or sending path does not clear another path. Each source needs its own pass and alignment check.4

When a check fails

A failure sends you back to the record or sending path responsible for that result. Keep the troubleshooting loop narrow, then send another external test after the configuration is corrected.

Verify all SPF, DKIM and DMARC DNS records when authentication fails.19 When bounce rates are high, verify the authentication records as part of the diagnosis.20 Use an authentication testing service when you need another check of the setup.21

If the SPF result fails, inspect the SPF record and the Return Path from the message. If DKIM fails, check the selector lookup and the signature result. If DMARC fails, check the record syntax and the alignment shown in the real headers. These checks tell you which part of the path needs attention before you retest.

What not to do

These shortcuts create a false sense of readiness.

  • Do not record a partial SPF or DKIM result as a pass. An email either passes or fails those checks.22
  • Do not stop monitoring after the initial setup. Monitoring authentication failures is part of DKIM governance.23

Tool for this

Sending from your own mailboxes, safely paced

Intedat covers the basics here properly. It sends from the Gmail, Microsoft 365 or SMTP mailbox you already own, shows SPF, DKIM and DMARC checks for a custom domain and rechecks them, and the daily limit per mailbox tops out at 100 inside a sending window you set per workflow. It will not warm a mailbox up for you, so that part stays your job.

Open Intedat

Sources

  1. 1
    “Authenticate first. SPF, DKIM and DMARC must pass before the first send”
  2. 2
    “Domains that have not set up SPF, DKIM, and DMARC correctly may find that their emails get quarantined as spam, or are not delivered to their recipients.”
  3. 3
    “SPF, DKIM, and DMARC configuration;”
  4. 4
    “SPF or DKIM passes for each source, and DMARC alignment is confirmed from real headers.”
  5. 5
    “To check if SPF is already set up for your domain, use one of many free tools available on the internet.”
  6. 6
    “After setting up your SPF record, verify it is working correctly.”
  7. 7
    “To check if DKIM is already set up for your domain, use one of many free tools available on the internet.”
  8. 8
    “You can check this has been applied using a DKIM lookup service and your selector.”
  9. 9
    “The last step is to Run a DMARC Record Check to verify that the record you just created has the correct values and syntax.”
  10. 10
    “Second, send a test message to an external mailbox and inspect the message headers.”
  11. 11
    “In the message header, look for Authentication-Results.”
  12. 12
    “Receiving services use different formats for message headers, however the DKIM results should say something like DKIM=pass or DKIM=OK.”
  13. 13
    “Did the signature pass, and which domain appears in d=?”
  14. 14
    “These two headers are evaluated during SPF validation testing, at which point the server that received the email will compare two headers in the email, which are:”
  15. 15
    “The RFC5321.MailFrom/Return Path domain”
  16. 16
    “Validate all three by inspecting message headers and the compliance or authentication dashboards provided by your mailbox provider.”
  17. 17
    “Sender Policy Framework (SPF) is a way for a domain to list all the servers they send emails from.”
  18. 18
    “Meanwhile, DMARC tells mail servers what to do when DKIM or SPF fail, whether that is marking the failing emails as "spam," delivering the emails anyway, or dropping the emails altogether.”
  19. 19
    “Verify all DNS records are properly configured (SPF, DKIM, DMARC)”
  20. 20
    “Verify that your authentication records (SPF, DKIM, DMARC) are properly configured”
  21. 21
    “Test your authentication with tools like dmarcian or mail-tester”
  22. 22
    “An email either passes or fails SPF and DKIM.”
  23. 23
    “Monitoring authentication failures”