Common DMARC, SPF & DKIM Issues

Troubleshoot email authentication problems with step-by-step solutions for the most common issues.

Showing 6 of 6 issues

DMARC Record Not Found

DMARCCritical

Your domain does not have a DMARC record, leaving it vulnerable to email spoofing.

Symptoms

  • DNS lookup for _dmarc.yourdomain.com returns no results
  • Email security scanners flag missing DMARC
  • Potential for domain impersonation attacks

Common Causes

  • DMARC record was never created
  • Record was accidentally deleted
  • Wrong DNS hostname (missing _dmarc prefix)
  • DNS propagation still in progress

How to Fix

1

Create a DMARC record

Start with monitoring: v=DMARC1; p=none; rua=mailto:[email protected]

2

Add TXT record to DNS

Add at hostname: _dmarc.yourdomain.com

3

Wait for DNS propagation

Allow 15-30 minutes for changes to take effect

4

Verify the record

Use our checker tool to confirm setup

Read detailed guideCheck if fixed

Multiple DMARC Records Detected

DMARCCritical

More than one DMARC record exists for your domain, which makes DMARC invalid.

Symptoms

  • Email authentication failures
  • Unpredictable DMARC behavior
  • Some receivers may ignore all DMARC records

Common Causes

  • Accidentally created duplicate records
  • Multiple teams managing DNS without coordination
  • Old DMARC record not removed when updating

How to Fix

1

Identify all DMARC records

Check your DNS for all TXT records at _dmarc.yourdomain.com

2

Choose the correct record

Determine which DMARC policy you want to enforce

3

Delete duplicate records

Remove all but one DMARC record from DNS

4

Verify cleanup

Confirm only one DMARC record remains

Read detailed guideCheck if fixed

SPF Record Exceeds DNS Lookup Limit

SPFCritical

Your SPF record requires more than 10 DNS lookups, causing it to fail validation.

Symptoms

  • SPF validation returns permerror
  • Email deliverability issues
  • Some mail servers reject your emails

Common Causes

  • Too many include: mechanisms
  • Nested includes that cause lookup multiplication
  • Multiple redirect mechanisms

How to Fix

1

Audit current lookups

Count all include:, a:, mx:, exists:, and redirect: mechanisms

2

Flatten nested includes

Replace includes with direct IP addresses where possible

3

Remove unnecessary includes

Eliminate unused mail service providers

4

Consider SPF macros

Use macros to reduce lookup count for complex setups

Read detailed guideCheck if fixed

SPF Record Not Found

SPFCritical

Your domain lacks an SPF record, allowing anyone to spoof your domain.

Symptoms

  • No SPF record in DNS
  • Emails may be marked as spam
  • Higher risk of domain spoofing

Common Causes

  • SPF record never created
  • Accidentally deleted
  • Wrong record type (not TXT)

How to Fix

1

Identify authorized mail servers

List all IPs and services that send email for your domain

2

Create SPF record

Format: v=spf1 include:_spf.google.com -all

3

Add to DNS as TXT record

Add at your root domain (yourdomain.com)

4

Verify SPF record

Check that record is properly formatted and accessible

Read detailed guideCheck if fixed

DKIM Selector Not Found

DKIMWarning

The DKIM selector being used by your mail server is not published in DNS.

Symptoms

  • DKIM validation fails
  • Authentication-Results header shows dkim=none
  • Reduced email deliverability

Common Causes

  • DKIM record not published in DNS
  • Wrong selector name in DNS
  • Mail server using different selector than what's in DNS
  • Typo in selector name

How to Fix

1

Identify the selector

Check your email headers for the DKIM selector being used

2

Get the public key

Obtain the public key from your mail server/provider

3

Publish DKIM record

Add TXT record at selector._domainkey.yourdomain.com

4

Verify DKIM setup

Send a test email and check DKIM validation passes

Read detailed guideCheck if fixed

DMARC Policy Set to None

DMARCInfo

Your DMARC policy is p=none, providing monitoring only without enforcement.

Symptoms

  • DMARC configured but not blocking spoofed emails
  • Domain still vulnerable to impersonation
  • Reports show failed authentications with no action taken

Common Causes

  • Initial monitoring phase
  • Hesitation to enforce stricter policy
  • Waiting to resolve authentication issues

How to Fix

1

Review DMARC reports

Analyze 2-4 weeks of reports to identify all legitimate senders

2

Fix authentication issues

Ensure all legitimate email sources pass SPF or DKIM

3

Move to quarantine

Change policy to p=quarantine for testing

4

Eventually enforce reject

After confirming no legitimate email blocked, set p=reject

Read detailed guideCheck if fixed

Need Help Diagnosing Your Issue?

Use our free checker tool to identify problems with your email authentication setup.

Check Your Domain Now