How to Verify Your Email Authentication Is Working
You set up SPF, DKIM, and DMARC months ago. Your IT person said everything looked good. But your emails are still landing in spam, your bounce rates are creeping up, and you have no idea if your authentication is actually functioning correctly.
Here is the uncomfortable truth: authentication can break silently. A DNS change, a new sending service, an expired DKIM key, or a misconfigured subdomain can cause failures that you will not notice until your deliverability tanks. The only way to know your authentication is working is to actively test and monitor it.
This guide covers every method for verifying your email authentication, from quick manual checks to ongoing automated monitoring.
Method 1: Checking Email Headers Manually
Every email carries authentication results in its headers. This is the fastest way to check whether a specific email passed SPF, DKIM, and DMARC.
In Gmail: Open the email, click the three dots in the top right, and select "Show original." This opens a new tab showing the full email source. At the top, you will see a summary showing SPF, DKIM, and DMARC results. You want to see PASS for all three.
In Outlook: Open the email, click File, then Properties. The "Internet headers" box at the bottom contains the raw headers. Search for "Authentication-Results" to find the SPF, DKIM, and DMARC verdicts.
What to look for in the headers:
spf=pass means the sending server is authorized by your SPF record. spf=fail or spf=softfail means the server is not listed in your SPF record or your SPF record has errors.
dkim=pass means the cryptographic signature verified correctly. dkim=fail means the signature did not match the public key in your DNS, which could indicate a misconfigured key or the email was modified in transit.
dmarc=pass means the email passed DMARC alignment (either SPF or DKIM passed and aligned with the From domain). dmarc=fail means neither SPF nor DKIM properly aligned with your From domain.
You should test emails from every sending service individually. Send a test from Gmail, another from Mailchimp, another from your cold email tool, and check the headers for each one. A common scenario is SPF passing for your primary email but failing for a secondary service that was not added to your SPF record.
Method 2: Online Testing Tools
Manual header checking works for spot checks, but online tools give you a more comprehensive view with specific recommendations.
mail-tester.com. This is probably the easiest tool to use. You send an email to a randomly generated address, and the tool analyzes everything about your email: authentication, content, formatting, blacklist status. You get a score out of 10 with detailed breakdowns. The free tier gives you a few tests per day. For regular testing, the paid plans are worth it.
MXToolbox. Enter your domain at mxtoolbox.com and run their suite of checks. The SPF lookup tool shows your full SPF record and counts the number of DNS lookups (remember the 10-lookup limit). The DKIM lookup lets you verify a specific selector. The DMARC lookup checks your DMARC record syntax and policy. MXToolbox also checks if your domain or IP is on any blacklists.
Google Admin Toolbox Check MX. Available at toolbox.googleapps.com/apps/checkmx, this tool verifies your MX records, SPF, DKIM, and DMARC in one pass. It is designed for Google Workspace but works for any domain.
EasyDMARC. Their free tools include an SPF validator, DKIM checker, and DMARC analyzer. The DMARC analyzer is particularly useful because it checks not just syntax but also alignment logic and potential issues with your policy configuration.
Dmarcian. Another strong option for DMARC-specific analysis. They offer a free DMARC inspector that checks your record and explains what each component means. Their paid service provides ongoing DMARC report analysis.
Method 3: Google Postmaster Tools
If you send any volume of email to Gmail addresses (and nearly every business does), Google Postmaster Tools is essential. It is free and provides data that no other tool can give you.
To set up Google Postmaster Tools: go to postmaster.google.com, add your domain, and verify ownership by adding a DNS TXT record. Once verified, you get access to dashboards showing your domain reputation (High, Medium, Low, Bad), spam rate, authentication success rates for SPF, DKIM, and DMARC, encryption percentage, and delivery errors.
The authentication dashboard is what matters here. It shows you the percentage of your emails that pass SPF, DKIM, and DMARC over time. If you see a sudden drop in pass rates, something changed in your DNS or sending configuration. The domain reputation dashboard correlates directly with these authentication results and your engagement metrics.
One limitation: Google Postmaster Tools only shows data if you send a meaningful volume of email to Gmail addresses. If you send fewer than a few hundred emails per day to Gmail, you may not see any data. But for most B2B senders, the data is available and incredibly useful.
Method 4: Microsoft SNDS
Microsoft Smart Network Data Services (SNDS) is the equivalent of Google Postmaster Tools for Outlook, Hotmail, and Live.com addresses. Given that Outlook B2B inbox placement sits at just 26.77%, monitoring your Microsoft reputation is critical.
SNDS shows you data about your sending IPs, including complaint rates, spam trap hits, and overall reputation. It does not show authentication results as granularly as Google Postmaster Tools, but it gives you a clear picture of how Microsoft views your sending behavior.
To access SNDS, go to sendersupport.olc.protection.outlook.com/snds and sign in with a Microsoft account. You will need to verify ownership of your sending IPs, which typically means working with your email service provider.
Method 5: DMARC Aggregate Reports
If you have a DMARC record with an rua= tag (and you should), you are already receiving daily reports from mailbox providers. These XML reports contain detailed information about every email sent from your domain, including which servers sent them, whether SPF and DKIM passed, and whether DMARC alignment succeeded.
The raw XML reports are nearly impossible to read. Use a parsing service to make them useful:
dmarcian: Comprehensive DMARC report analysis with detailed source identification. Paid service with a free trial.
Valimail: Strong at identifying unauthorized senders and helping you move toward DMARC enforcement. Free tier available.
EasyDMARC: Affordable DMARC monitoring with good visualization. Free tier covers basic monitoring.
Postmark DMARC: Free weekly DMARC report digests sent to your inbox. Good for basic monitoring without a full dashboard.
The value of DMARC reports is that they catch problems you would never find through spot checks. Maybe a developer set up a staging server that sends emails from your domain without authentication. Maybe a former employee is using an old service that still sends as your domain. DMARC reports surface all of this.
Method 6: Automated Monitoring
Manual testing is good for initial setup and periodic audits. But you need automated monitoring to catch issues in real time.
Set up alerts for DMARC failures. Most DMARC analysis services let you configure alerts when failure rates exceed a threshold. Set an alert for when DMARC pass rate drops below 95%.
Monitor your blacklist status. Services like MXToolbox Monitoring, HetrixTools, and UltraTools check your domain and IPs against blacklists on a regular schedule and alert you if you get listed. Getting listed on Spamhaus or Barracuda can devastate your deliverability overnight. Early detection is critical.
Track authentication in your ESP. Most email service providers show authentication results in their analytics. Check whether your ESP provides SPF, DKIM, and DMARC pass rates in their reporting dashboard. Some show this per-campaign, which helps identify which campaigns have issues.
Weekly email test routine. Send a test email from each of your sending services to a test account every week. Check the headers. This takes five minutes and catches configuration drift before it causes problems.
What to Do When Authentication Fails
You ran your checks and something is failing. Here is how to diagnose and fix the most common issues:
SPF failing: Check that your SPF record includes the sending service. Verify you are under the 10-lookup limit (use MXToolbox SPF checker to count). Make sure you have only one SPF record (not two). Check that the SPF record syntax is correct (common errors: missing spaces, wrong include domains).
DKIM failing: Verify the DKIM DNS record exists at the correct selector. Check that the record value matches what your email service provided (copy-paste errors are common). Confirm the record type is correct (TXT or CNAME, depending on the service). Check if the DKIM key has expired or been rotated by the service without updating DNS.
DMARC failing (but SPF and DKIM pass): This is an alignment issue. The domain used in SPF or DKIM does not match your From domain. Check if your sending service uses its own domain for the envelope sender or DKIM signing instead of yours. Configure custom sending domains in the service to fix alignment.
Everything was working and suddenly broke: Check if any DNS changes were made recently. Check if your email service provider changed their sending infrastructure. Check if someone added a new sending service without updating DNS. Check your SPF lookup count (adding one more include might have pushed you over 10).
Building an Authentication Testing Calendar
Rather than testing randomly, set up a regular schedule:
Weekly: Send test emails from each service, spot-check headers. Takes 5-10 minutes.
Monthly: Run full MXToolbox and mail-tester checks. Review Google Postmaster Tools trends. Check blacklist status. Takes 20-30 minutes.
Quarterly: Full DMARC report review. Audit all sending services and DNS records. Check DKIM key rotation status. Review SPF lookup count. Takes 1-2 hours.
After any change: Whenever you add or remove a sending service, change DNS records, or modify email infrastructure, run immediate tests. Do not wait for the scheduled check.
Authentication and List Verification
Passing authentication gets your emails accepted by receiving servers. But accepted does not mean delivered to the inbox. If you are sending to invalid addresses, your bounce rate goes up, your sender reputation goes down, and even perfectly authenticated emails end up in spam.
Catch-all domains present a particular challenge. Standard verification marks them as "catch-all" without resolving whether specific addresses actually exist. You end up either dropping a significant portion of your list or risking bounces. CatchallVerifier resolves catch-all addresses to determine which ones are actually deliverable, so you can send confidently to addresses that standard tools leave uncertain.
Perfect authentication plus verified addresses equals reliable delivery. Skip either one and you are leaving performance on the table.
