Authentication is a sender-side check
SPF authorizes sending infrastructure for an envelope domain. DKIM attaches a signature that a recipient can verify with a published public key. DMARC relates authenticated identifiers to the visible From domain and describes the domain owner's policy. These checks concern the sender, not whether a recipient mailbox exists.
Current DMARC specifications are RFC 9989 and its reporting companions. The older RFC 7489 remains common in existing documentation but has been superseded. Check current platform guidance when deploying.
Diagnose a real message
- Send a controlled message from each authorized platform to an inbox you own.
- Inspect its full headers, including Authentication-Results, visible From, Return-Path and the DKIM signing domain.
- Compare the domains that passed authentication with the visible From domain. A successful SPF check by itself does not establish DMARC alignment.
- Record which platform sent the message. A correct setup for your CRM does not prove that billing or support messages are configured correctly.
Inspect DNS without changing it
dig TXT example.com
dig TXT selector._domainkey.example.com
dig TXT _dmarc.example.comReplace the example domain and selector with values from your actual sending configuration. A DNS lookup shows published records; it does not prove that outbound messages are signed or aligned. Avoid copying an example SPF include into production without checking your provider's instructions.
A staged rollout checklist
Inventory authorized senders before changing enforcement. Assign an owner to each sender, capture a working test message and review aggregate reports for unexpected sources. Configure DKIM at the sending platform and check the resulting signature in a received message.
Illustrative alignment failure: the visible From is your company domain but a service signs with its own unrelated domain and uses its own envelope sender. Authentication may succeed while DMARC still fails. Follow that service's custom-domain configuration and test again; adding unrelated recipient checks will not help.
Move toward stronger enforcement only after reviewing legitimate flows, including forwarding and support tools. Schedule a rollback path and monitor rejected or quarantined legitimate mail. Report data can contain operational information: limit access and retention.
Tools and references
Use Google Admin Toolbox Check MX for a domain-level inspection and your provider's header viewer for message evidence. Continuous report processing is a separate need from a one-time DNS lookup.