DNS record setup not working (SPF, DKIM, DMARC)
Step-by-step troubleshooting for DNS authentication records:
- Propagation delay — DNS changes can take 24-48 hours to take effect globally (most providers publish within minutes). If you just added records, wait a few minutes and run Check DNS again on the mailbox — every check you run looks the records up fresh and the dialog shows the time it was checked.
2) SPF record issues:
- Only ONE SPF record per domain is allowed. If you have multiple, merge them into one.
- Format: v=spf1 include:_spf.google.com include:other.provider.com ~all
- Check at: MXToolbox SPF Lookup or dig TXT yourdomain.com
- Common mistake: Adding a second SPF record instead of editing the existing one.
3) DKIM record issues:
- DKIM records are usually CNAME or TXT records at a specific subdomain (e.g., google._domainkey.yourdomain.com).
- The record name and value are provided by your email provider — use their exact values.
- Common mistake: Adding the record to the wrong subdomain or including extra characters.
4) DMARC record issues:
• Add ONE TXT record:
Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none
• DMARC never goes on Host @. Host @ is your domain itself, where SPF lives; mail services only read DMARC at _dmarc.yourdomain.com. If you added a DMARC record on @, delete it and add it at _dmarc.
• In the Host box type only _dmarc. Namecheap, GoDaddy and most registrars add your domain for you; typing _dmarc.yourdomain.com there creates _dmarc.yourdomain.com.yourdomain.com, which no one will find.
• The value is exactly v=DMARC1; p=none, with nothing after 'none' (no domain name). p=none is monitor-only and never blocks mail. Later you can add reports, e.g. v=DMARC1; p=none; rua=mailto:[email protected].
• Common mistake: missing the underscore in _dmarc.
5) Verification in WarmySender:
- Go to Mailboxes (or Analytics > Mailboxes) to see SPF/DKIM/DMARC status per domain. Hover any badge for the full explanation.
- Valid — the record is published and reads correctly.
- Missing — we checked and found no valid record. Act on this one.
- Not checked — we have not looked yet. Run Test Connection on the mailbox and we will check it.
- On bounce domain (SPF only) — your SPF is published on the bounce domain your provider sends with, which is the domain SPF is checked against for your mail. Nothing to add on your sending domain, and nothing to fix.
- Signing confirmed (DKIM) — we can see your mail actually being signed as it goes out. This is checked on real mail you sent, so it is stronger than a records lookup and there is nothing to fix.
- If SPF shows Missing but your own test emails pass SPF, check whether your provider sends using a bounce domain such as mail.yourdomain.com — the record often lives there rather than on the sending domain.
6) Still failing?
• Flush DNS cache: nslookup -type=txt yourdomain.com 8.8.8.8
• Check your DNS provider did not add extra quotes around TXT values.
• Verify you are editing the correct domain (not a subdomain).
• Contact your DNS provider support if records appear correct but still fail verification.