The Gap Between Setup and Reality
You followed a setup guide, added your SPF TXT record, configured DKIM with your email provider, and published a DMARC record. Everything should be working. But is it? The uncomfortable truth is that many organizations run for months with broken or partially broken authentication without realizing it.
A 2024 analysis by EasyDMARC found that roughly 30% of domains with published DMARC records had at least one misconfiguration that caused partial authentication failures. These were not domains without DMARC. These were domains where someone had gone through the setup process and believed everything was fine.
The problem is that email authentication fails silently. Your emails still get delivered (most of the time). Your open rates might dip slightly, but you attribute that to subject lines or timing. Meanwhile, broken DKIM or an overstuffed SPF record is quietly pushing your messages toward spam folders instead of primary inboxes. The gap between the average delivery rate (95%+) and the average inbox placement rate (83.1%) often comes down to exactly these kinds of authentication issues.
Quick Tests You Can Run Right Now
Method 1: Send Yourself an Email and Read the Headers
The most direct test is to send an email from each of your sending services to a Gmail account, then inspect the raw message headers. In Gmail, open the message, click the three dots menu, and select "Show original." At the top, Gmail shows a summary with SPF, DKIM, and DMARC results.
What you want to see:
- SPF: PASS with your domain listed
- DKIM: PASS with your domain (not the service provider's domain)
- DMARC: PASS
If SPF shows PASS but the domain listed is not yours (for example, it shows the email service's domain), SPF is passing but not aligning for DMARC purposes. Similarly, if DKIM shows PASS but the signing domain (d=) is the service provider's domain rather than yours, DKIM alignment fails for DMARC.
Repeat this test for every service that sends email as your domain. Google Workspace, your marketing platform, your CRM, your cold email tool, and your transactional email service should all show PASS with proper alignment.
Method 2: MXToolbox
MXToolbox (mxtoolbox.com) is a free tool that checks your DNS records from the outside. Use it to verify:
- SPF check: Enter your domain and it will display your SPF record, count the DNS lookups, and flag any errors. Pay attention to the lookup count, because if it exceeds 10, your SPF is broken even if the record looks correct.
- DKIM check: Enter your domain and the DKIM selector (e.g., google for Google Workspace, k1 for Mailchimp). It will retrieve the DKIM public key and verify it is properly formatted.
- DMARC check: Enter your domain and it will display your DMARC record and flag any syntax issues.
Method 3: mail-tester.com
Mail-tester gives you a unique email address. You send a message to it from each sending service, and it scores your email on a 10-point scale covering authentication, content, and blacklist status. The authentication section shows detailed pass/fail results for SPF, DKIM, and DMARC with explanations of any failures.
The free tier allows a few tests per day, which is plenty for an initial audit. Send one test email from each of your sending services and review the results. Anything scoring below 8/10 needs investigation.
Method 4: Google Admin Toolbox
Google provides a set of diagnostic tools at toolbox.googleapps.com. The "Check MX" tool verifies your MX records and email configuration specifically from Google's perspective, which matters because Gmail handles a significant portion of B2B email.
The "Messageheader" tool lets you paste raw email headers and get a formatted analysis of the authentication chain. This is useful when you want to understand the exact sequence of checks that a message went through.
Ongoing Monitoring with DMARC Reports
One-time tests tell you whether authentication is working right now. DMARC aggregate reports tell you whether it is working consistently over time. This is the difference between checking your blood pressure once and monitoring it daily.
If your DMARC record includes rua=mailto:reports@yourdomain.com, you are already receiving aggregate reports from every major mailbox provider. These arrive as XML files, usually daily. Gmail, Microsoft, Yahoo, and others all send them.
Raw DMARC reports are XML files that are not exactly pleasant to read. Use a free analysis service instead:
- Postmark DMARC: Free weekly digest of your DMARC data with a clean interface
- dmarcian: Free tier that processes and visualizes aggregate reports
- EasyDMARC: Free plan with detailed reporting dashboard
- DMARC Analyzer: Free tier with basic report processing
These services give you a dedicated email address to use in your rua= tag. They collect the reports, parse the XML, and present dashboards showing authentication pass rates by source, failures by domain, and trends over time.
What to Look for in DMARC Reports
Focus on three things:
Overall pass rate: You want to see 95%+ of your email passing DMARC. If you are below this, something is misconfigured. Note that some percentage of failures is normal from forwarded email, but it should be a small fraction.
Failures by source: The reports show which IP addresses are sending as your domain and failing authentication. If you recognize the IP as one of your sending services, that service needs its authentication fixed. If you do not recognize the IP, someone else is sending as your domain (either unauthorized use or a service you forgot about).
Alignment failures: Some messages might pass SPF or DKIM individually but fail DMARC alignment. This usually means a sending service is authenticating with its own domain rather than yours. The fix is to enable custom domain authentication in that service.
Testing After Changes
Any time you modify your authentication setup (add a new sending service, change SPF records, rotate DKIM keys, update DMARC policy), run through this post-change testing protocol:
- Wait 30-60 minutes for DNS propagation
- Run MXToolbox checks for SPF, DKIM, and DMARC
- Send test emails from the affected service to Gmail, Outlook, and Yahoo test accounts
- Check raw headers on each test email for PASS results
- Monitor DMARC reports for the next 48-72 hours looking for any new failures
The 48-72 hour monitoring window matters because some receiving servers cache DNS records for up to 48 hours (depending on TTL settings). A change that looks fine immediately might cause failures at servers that are still using cached records.
The Quarterly Authentication Audit
Set a recurring quarterly calendar event for an authentication audit. The checklist takes about 30 minutes:
- Run SPF lookup count check (should be 10 or fewer)
- Verify SPF includes match your current sending services (remove canceled services, add new ones)
- Test DKIM for each sending service using MXToolbox
- Review DMARC aggregate report trends for the past quarter
- Check for any new sending sources in DMARC reports that you did not authorize
- Verify DMARC policy is appropriate (start at p=none, progress to quarantine, then reject)
- Confirm Google Postmaster Tools shows your domain reputation as Medium or High
Google Postmaster Tools (postmaster.google.com) deserves special attention. It shows your domain reputation as seen by Gmail specifically, broken into four levels: High, Medium, Low, and Bad. Senders with High reputation and a score above 90 see approximately 92% inbox placement. Those with Low or Bad reputation see less than 50% inbox placement at Gmail. Since Gmail processes over 1.8 billion accounts, your reputation there directly impacts a huge portion of your email.
If Google Postmaster shows your reputation dropping, check your authentication first. A decline in DKIM or SPF pass rates is often the earliest signal that something has gone wrong, and it is much easier to fix authentication than to recover from reputation damage caused by months of partial authentication failure.
Automating Authentication Monitoring
For teams that send high volumes or manage multiple domains, manual quarterly checks may not be frequent enough. Several tools offer automated monitoring with alerts:
- dmarcian: Sends alerts when DMARC pass rates drop below configured thresholds
- Valimail: Automated DMARC monitoring and enforcement with real-time alerts
- MXToolbox Monitoring: Paid tier that checks your DNS records on a schedule and alerts on changes or failures
- Postmark DMARC: Free weekly digests flag significant changes in your authentication data
The goal is to catch authentication problems within days rather than months. A broken DKIM selector that goes unnoticed for three months does far more reputation damage than one that gets fixed within a week. Automated monitoring turns authentication from a set-and-forget (and-pray) approach into an actively managed part of your email infrastructure.
