This checklist helps you confirm your SPF, DKIM, and DMARC records are published correctly after you:
set up email authentication for a sending domain, or
fixed an issue flagged by Global Health checks for domains and email accounts in Sequences.
If Hunter flagged a specific warning, start with the fix guide: Fix SPF, DKIM, and DMARC issues detected by Hunter (Domain Health Check)
If you’re not sure where DNS is managed or how to find the right values for your SMTP/IMAP setup: Add SPF, DKIM, and DMARC records for a custom SMTP/IMAP sending domain
Before you start
DNS changes can take time
Most updates show up within minutes, but depending on your DNS provider and TTL, it can take up to 24–48 hours. If you just made changes, wait a bit and re-check.
Make sure you edited DNS in the right place
DNS is often managed in one of these places:
your registrar (GoDaddy, Namecheap, etc.)
Cloudflare
your hosting provider
Squarespace Domains
If you’re editing DNS in the wrong place, nothing will change (even if your DNS dashboard shows the records).
Verification tools for SPF, DKIM and DMARC
Quick checks (MXToolbox)
SPF lookup: https://mxtoolbox.com/spf.aspx
DKIM lookup: https://mxtoolbox.com/dkim.aspx
DMARC lookup: https://mxtoolbox.com/dmarc.aspx
Advanced (shows raw DNS results)
Google Admin Toolbox Dig: https://toolbox.googleapps.com/apps/dig/
Step 1 — Verify SPF (TXT on the root domain)
Where it should be published
root domain (example.com)
record type: TXT
What “good” looks like
exactly one SPF record
it starts with: v=spf1
it ends with a clear policy like ~all or -all
Common SPF problems and how to spot them ⚠️
No SPF record found
lookup returns “no record” or nothing starting with v=spf1
Multiple SPF records
lookup shows two separate TXT records starting with v=spf1
SPF too complex / too many DNS lookups
lookup errors or warnings about DNS lookups / permerror
SPF policy too permissive (+all) or neutral (?all)
record ends with +all or ?all
Step 2 — Verify DKIM (TXT on a selector hostname)
Where it should be published
DKIM is not on the root domain.
It’s usually on a hostname like: selector._domainkey.example.com
What “good” looks like
you can retrieve a TXT record at the selector hostname provided by your email provider
it contains something like v=DKIM1 and a long public key
Common DKIM problems and how to spot them ⚠️
No DKIM record found
lookup shows “no record” at the selector hostname
Wrong hostname (selector)
DKIM exists, but not on the selector your provider expects
Value truncated / split incorrectly
record looks cut off, broken, or incomplete (missing parts of the key)
If you don’t know the selector hostname, you’ll need to get it from your provider/sending service documentation or your admin team.
Step 3 — Verify DMARC (TXT at _dmarc)
Where it should be published
_dmarc.example.com
record type: TXT
What “good” looks like
record starts with: v=DMARC1
record includes a policy tag: p=none, p=quarantine, or p=reject
Common DMARC problems and how to spot them ⚠️
No DMARC record found
lookup returns “no record”
Multiple DMARC records
lookup shows multiple TXT entries at _dmarc
Invalid DMARC format
record doesn’t start with v=DMARC1 or is missing p=
Troubleshooting (most common fixes)
The record looks correct in my DNS provider, but tools don’t show it
wait for propagation (especially if you just made changes)
confirm the domain’s nameservers point to the DNS provider you edited
re-check the hostname:
SPF → root domain
DKIM → selector._domainkey
DMARC → _dmarc
Hunter still shows the issue after I fixed DNS
wait 15–30 minutes and refresh the Domain Health Check
if it’s still flagged after 24–48 hours, share:
the domain
screenshots of the DNS records you added
the output from the SPF/DKIM/DMARC lookup tools
and we’ll help you confirm what’s missing
Want the deeper explanation?
If you want background on what SPF, DKIM, and DMARC do and why they matter, see our guide here.