# Verifying your DNS records

Source: https://catalystgroup.gg/docs/email-delivery/verify-dns-records/
Updated: 2026-10-19 · By Duane Garner

Check SPF, DKIM and DMARC with the plugin's domain check, command-line lookups, online checkers and Gmail's Show original view.

Once you have added SPF, DKIM and DMARC records, you want proof that they work. This article shows four ways to check, from quickest to most reliable. It is for anyone who has just followed [Adding DNS records](https://catalystgroup.gg/docs/email-delivery/dns-records/) or is chasing a spam problem.

 

There is an important difference between a record **existing** and a message **passing**. A record can be present but wrong, or present but not matching the domain your mail service signs with. The last method below, reading a real message's headers, is the one that settles it.

 

## 1. The plugin's domain check

 

Every test email runs a quick check of your From Email's domain.

 
1. Send a test
  Go to **CRM-NG SMTP → Tools → Email Test** and send one.
2. Read the result
  If something is missing you see *"The test email might have sent, but its deliverability should be improved."* and a **Domain Check Results** list. If all is well, the success screen shows a **Deliverability and domain authentication** panel with each record marked found or not found.

 

What it checks:

 
- **SPF** — that a record exists, and that it includes the value your chosen mailer normally needs. A typical warning: *"The SPF record does not appear to include sendgrid.net, which your selected mailer normally needs."*
- **DMARC** — that a record exists at `_dmarc.yourdomain.com`.
- **DKIM** — the result panel looks for the `google` selector used by Google Workspace. For other services DKIM is not checked here, because each provider uses its own selector name.

 

The lookups run from your own web server. Nothing is sent to an outside checking service. The same check feeds the "Is email domain configured properly?" test in **Tools → Site Health**. See [Site Health checks](https://catalystgroup.gg/docs/email-delivery/site-health-checks/).

 

## 2. Command-line lookups

 

If you have a terminal, `dig` (macOS, Linux) or `nslookup` (Windows) show exactly what the world sees. Replace `yourdomain.com` with your domain.

 

SPF:

 

```
dig +short TXT yourdomain.com
nslookup -type=TXT yourdomain.com
```

 

Look for one line starting `v=spf1` that contains your mail service's include.

 

DMARC:

 

```
dig +short TXT _dmarc.yourdomain.com
```

 

Look for a line starting `v=DMARC1`.

 

DKIM (you need the selector your provider gave you, such as `google`, `selector1` or `s1`):

 

```
dig +short TXT google._domainkey.yourdomain.com
dig +short CNAME selector1._domainkey.yourdomain.com
```

 

A TXT answer should start `v=DKIM1`. A CNAME answer should point at your provider.

 

No answer usually means the record was added under the wrong name (often with the domain added twice, like `_dmarc.yourdomain.com.yourdomain.com`) or has not spread yet.

 

## 3. Online checkers

 

Free web tools run the same lookups and explain problems in plain language. Search for an "SPF checker", "DKIM checker" or "DMARC checker"; well-known options include MXToolbox, dmarcian and the Google Admin Toolbox. They are handy for spotting two SPF records, too many lookups, or a syntax error.

 

## 4. Read a real message's headers (the reliable test)

 

Send a test email to a Gmail address, then:

 
1. Open the message
  In Gmail on the web, open the test email.
2. Show the original
  Click the three-dot menu next to the reply arrow and choose **Show original**.
3. Read the summary
  At the top, Gmail lists **SPF**, **DKIM** and **DMARC**, each with PASS, FAIL or NEUTRAL, and the domain it checked.

 

What you want to see:

 
- **SPF: PASS** with your domain (or your provider's bounce domain).
- **DKIM: PASS** with **your** domain, not only the provider's.
- **DMARC: PASS.** DMARC passes when SPF or DKIM passes **and** matches the domain in your From address. This matching is called *alignment*.

 

If DKIM passes but shows the provider's domain (for example `sendgrid.net`), you have not finished domain authentication in the provider's dashboard. Go back and complete it.

 

In Outlook, open the message, choose **View → View message source** (or **Message details**), and find the `Authentication-Results` line. It shows `spf=pass`, `dkim=pass` and `dmarc=pass` in the same way.

 

## When the checks disagree

 
- **Plugin says missing, headers say PASS:** your server's DNS resolver may still be caching an old answer. Wait and test again.
- **Records found, headers say FAIL:** the values are wrong or unaligned. Compare each value letter by letter with your provider's dashboard.
- **Everything passes, mail still goes to spam:** authentication is only one factor. See [Emails landing in spam](https://catalystgroup.gg/docs/email-delivery/emails-landing-in-spam/).

 

## Related

 
- [Adding DNS records: SPF, DKIM and DMARC](https://catalystgroup.gg/docs/email-delivery/dns-records/)
- [Sending a test email](https://catalystgroup.gg/docs/email-delivery/send-a-test-email/)
- [Emails landing in spam](https://catalystgroup.gg/docs/email-delivery/emails-landing-in-spam/)
- [Site Health checks](https://catalystgroup.gg/docs/email-delivery/site-health-checks/)