Talk to our team

Documentation

✉️ Email Delivery

Documentation, reference material and tutorials for CRM-NG SMTP Email: setup guides for every mail service, troubleshooting, and one article per error message.

Verifying your DNS records

Updated

By Duane GarnerChief Executive Officer (CEO)
Summarize: Claude ChatGPT View Markdown
On this page

Check SPF, DKIM and DMARC with the plugin's domain check, command-line lookups, online checkers and Gmail's Show original view.

Once you have added SPF, DKIM and DMARC records, you want proof that they work. This article shows four ways to check, from quickest to most reliable. It is for anyone who has just followed Adding DNS records or is chasing a spam problem.

There is an important difference between a record existing and a message passing. A record can be present but wrong, or present but not matching the domain your mail service signs with. The last method below, reading a real message's headers, is the one that settles it.

1. The plugin's domain check

Every test email runs a quick check of your From Email's domain.

  1. Send a test

    Go to CRM-NG SMTP → Tools → Email Test and send one.

  2. Read the result

    If something is missing you see "The test email might have sent, but its deliverability should be improved." and a Domain Check Results list. If all is well, the success screen shows a Deliverability and domain authentication panel with each record marked found or not found.

What it checks:

  • SPF — that a record exists, and that it includes the value your chosen mailer normally needs. A typical warning: "The SPF record does not appear to include sendgrid.net, which your selected mailer normally needs."
  • DMARC — that a record exists at _dmarc.yourdomain.com.
  • DKIM — the result panel looks for the google selector used by Google Workspace. For other services DKIM is not checked here, because each provider uses its own selector name.

The lookups run from your own web server. Nothing is sent to an outside checking service. The same check feeds the "Is email domain configured properly?" test in Tools → Site Health. See Site Health checks.

2. Command-line lookups

If you have a terminal, dig (macOS, Linux) or nslookup (Windows) show exactly what the world sees. Replace yourdomain.com with your domain.

SPF:

dig +short TXT yourdomain.com
nslookup -type=TXT yourdomain.com

Look for one line starting v=spf1 that contains your mail service's include.

DMARC:

dig +short TXT _dmarc.yourdomain.com

Look for a line starting v=DMARC1.

DKIM (you need the selector your provider gave you, such as google, selector1 or s1):

dig +short TXT google._domainkey.yourdomain.com
dig +short CNAME selector1._domainkey.yourdomain.com

A TXT answer should start v=DKIM1. A CNAME answer should point at your provider.

No answer usually means the record was added under the wrong name (often with the domain added twice, like _dmarc.yourdomain.com.yourdomain.com) or has not spread yet.

3. Online checkers

Free web tools run the same lookups and explain problems in plain language. Search for an "SPF checker", "DKIM checker" or "DMARC checker"; well-known options include MXToolbox, dmarcian and the Google Admin Toolbox. They are handy for spotting two SPF records, too many lookups, or a syntax error.

4. Read a real message's headers (the reliable test)

Send a test email to a Gmail address, then:

  1. Open the message

    In Gmail on the web, open the test email.

  2. Show the original

    Click the three-dot menu next to the reply arrow and choose Show original.

  3. Read the summary

    At the top, Gmail lists SPF, DKIM and DMARC, each with PASS, FAIL or NEUTRAL, and the domain it checked.

What you want to see:

  • SPF: PASS with your domain (or your provider's bounce domain).
  • DKIM: PASS with your domain, not only the provider's.
  • DMARC: PASS. DMARC passes when SPF or DKIM passes and matches the domain in your From address. This matching is called alignment.

If DKIM passes but shows the provider's domain (for example sendgrid.net), you have not finished domain authentication in the provider's dashboard. Go back and complete it.

In Outlook, open the message, choose View → View message source (or Message details), and find the Authentication-Results line. It shows spf=pass, dkim=pass and dmarc=pass in the same way.

When the checks disagree

  • Plugin says missing, headers say PASS: your server's DNS resolver may still be caching an old answer. Wait and test again.
  • Records found, headers say FAIL: the values are wrong or unaligned. Compare each value letter by letter with your provider's dashboard.
  • Everything passes, mail still goes to spam: authentication is only one factor. See Emails landing in spam.
Go to Top