One pass pulls MX, SPF, DMARC and DKIM, grades each one, and links every problem to the fix. Everything runs in your browser against public DNS — no account, and nothing about the domain you check reaches our servers.
SPF lists which servers may send as your domain. Its most common failure is invisible: every include: costs a DNS lookup, and the limit is ten. Cross it and SPF does not degrade gracefully — it returns permerror and stops working entirely. A business adds one more marketing tool, quietly crosses the limit, and starts landing in spam with no obvious cause.
DKIM signs outgoing mail with a private key and publishes the public key in DNS. Unlike SPF it survives forwarding, which is why mail relayed through a mailing list can still authenticate.
DMARC is the instruction. Without it, SPF and DKIM results are advisory — a receiver sees the failure and decides for itself what to do. DMARC tells it, and rua= sends you reports showing who is sending as your domain. Most businesses find a genuine surprise in their first month of reports.
Record values below are the real ones for the two platforms most Central Oregon businesses run. Replace example.com with your domain, and give DNS changes an hour before re-testing.
Publish exactly one TXT record at your domain root. Not one per sender — one record listing every sender.
Microsoft 365 only:
v=spf1 include:spf.protection.outlook.com -all
Google Workspace only:
v=spf1 include:_spf.google.com ~all
Microsoft 365 plus a third-party sender:
v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all
If you are near the ten-lookup limit, remove senders you no longer use before adding another — that is almost always the real fix. Vendor guides: Microsoft 365 SPF · Google Workspace SPF.
DKIM is enabled in your mail platform's admin console, which then gives you the DNS records to publish. You cannot write it by hand — the key is generated for you.
Microsoft 365: Defender portal → Email authentication settings → DKIM, enable your custom domain, then publish the two CNAME records it gives you at selector1._domainkey and selector2._domainkey. Both are required, because key rotation alternates between them. On Cloudflare, make sure those records are DNS-only rather than proxied.
Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate the key, publish the TXT record it produces, then come back and click Start authentication — a step people routinely forget, which leaves DKIM published but switched off.
Vendor guides: Microsoft 365 DKIM · Google Workspace DKIM.
One TXT record at _dmarc.example.com. Start in monitoring mode and change nothing else:
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Read the reports for a few weeks until you can account for every legitimate sender — the CRM, the invoicing system, the scheduling tool nobody remembered. Then tighten:
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com
And finally:
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@example.com
Do not skip to p=reject. That is how you discover which department was using a bulk mailer you had never heard of — by having their mail rejected on a Monday morning. Vendor guides: Microsoft 365 DMARC · Google Workspace DMARC.
Microsoft 365 uses a single MX record, in the form example-com.mail.protection.outlook.com at priority 0 — get the exact hostname from the Microsoft 365 admin center, since it is derived from your domain name.
Google Workspace now uses one record at priority 1:
1 smtp.google.com
If a domain should not receive mail at all — a domain you only use for a website, or one you are parking — say so explicitly with a null MX rather than leaving it empty:
0 .
Then pair it with v=spf1 -all and v=DMARC1; p=reject; so nobody can spoof it. Parked domains are a favourite for spoofing precisely because nobody thinks to protect them.
DKIM selectors are arbitrary strings chosen by your mail provider. We probe twenty common ones — default, google, selector1, selector2 and so on — which covers Microsoft 365, Google Workspace and most major senders. A negative result means we did not find it at those names, not that DKIM is definitely absent. If you do not know your own selector, that is worth resolving either way.
Need the raw records rather than a verdict? The DNS lookup tool queries any record type directly.
If email authentication is one item on a longer list, that is what cybersecurity consulting and managed IT cover — and we are based in Bend.
We do managed IT, networking and security for businesses across Central Oregon.
Managed IT Services Call 541-508-8797