Skip to main content

Fix SPF, DKIM, and DMARC issues detected by Hunter (Health Check)

Understand each authentication warning and the exact steps to fix it.

Updated over 2 weeks ago

Hunter’s Domain Health Check verifies whether SPF, DKIM, and DMARC are present and consistent for your sending domain.

If Hunter flags an issue, inbox providers may have trouble validating your emails, which can reduce deliverability in Sequences.

If you need the provider-specific setup steps or you’re not sure where to edit DNS records, start here: How to find or create SPF, DKIM, and DMARC records for your domain


  • SPF record missing

What it means: your domain has no SPF record published. Inbox providers can’t confirm who is allowed to send emails for your domain.

What to do: add a single SPF TXT record based on your email provider’s documentation. Make sure it’s published on the root domain (example.com).

  • Multiple SPF records detected

What it means: SPF must be published as a single record. When multiple SPF records exist, SPF evaluation can fail or be ignored.

What to do: merge all SPF mechanisms (include:, ip4/ip6, etc.) into one SPF TXT record, then remove the extra SPF records.

  • SPF record misconfigured (invalid / too complex)

What it means: Hunter found an SPF record, but it looks invalid or too complex (for example: syntax issues or too many DNS lookups). Inbox providers may ignore it or treat SPF as failing.

What to do:

  • Confirm the SPF value follows valid SPF syntax

  • Remove duplicate or unused includes

  • Consolidate sending sources where possible (fewer include entries)

  • DKIM not configured

What it means: DKIM signing isn’t enabled for your domain, so emails can’t be cryptographically verified.

What to do: Enable DKIM in your email provider admin settings, then publish the DKIM TXT record(s) they provide.

  • DKIM configuration issue (invalid/incomplete)

What it means: DKIM records exist but look incomplete or invalid, so DKIM verification may fail.

What to do:

  • Confirm the record is published at the correct hostname (selector)

  • Make sure the value wasn’t truncated or split incorrectly

  • Re-copy the record from your provider and publish again if needed

  • DMARC not configured

What it means: your domain has no DMARC record. Inbox providers have no policy for what to do when SPF or DKIM fail, and the domain has less protection against spoofing.

What to do: publish a DMARC TXT record at _dmarc.yourdomain.com based on your provider’s documentation.

  • Multiple DMARC records detected

What it means: DMARC should be published as a single record at _dmarc. If multiple DMARC records exist, inbox providers may ignore DMARC.

What to do: keep one DMARC record and remove duplicates.

  • DMARC policy set to “none”

What it means: DMARC is in monitoring mode (p=none) and doesn’t enforce protection. It can still be valid, but it provides weaker trust signals than enforcement.

What to do: once SPF and DKIM are stable, consider enforcing DMARC (for example p=quarantine or p=reject) based on your internal email policy.

Helpful tools:

Did this answer your question?