What each record does
MX records name the servers that accept mail for your domain. Without them, nobody can send you anything.
SPF lists which servers are permitted to send mail claiming to be from your domain. DKIM adds a cryptographic signature to outgoing messages so a recipient can verify they were not altered and really came from you. DMARC ties the two together: it tells receiving servers what to do when SPF and DKIM fail, and where to send reports about it.
The three work as a set. SPF alone breaks when mail is forwarded. DKIM alone proves a message is authentic but says nothing about messages that are not signed. DMARC is what turns them into an enforceable policy.
Reading your DMARC policy
The p= tag is the important one. p=none means monitor only -- failures are reported but nothing is blocked, which is the correct starting point but not a destination. p=quarantine sends failing mail to spam. p=reject tells receivers to refuse it outright.
Most domains should end at p=reject. Getting there safely means starting at p=none, reading the aggregate reports that arrive at the rua address for a few weeks, confirming every legitimate sender passes, and only then tightening. Jumping straight to reject reliably blocks something you forgot about, usually invoices or a marketing platform.
Why SPF fails in ways that surprise people
SPF has a hard limit of ten DNS lookups per evaluation. Each include: mechanism costs at least one, and each of those can include others. Chain together Microsoft 365, a CRM, a helpdesk and a newsletter tool and you can exceed ten without any single entry looking unreasonable. Over the limit, SPF returns permerror and receivers treat it as a failure.
The other frequent mistake is ending with +all, which authorises every server on the internet and makes the record worthless. Use -all for strict rejection, or ~all as a softer step while testing.
DKIM selectors and why one may not be found
DKIM keys are published under a selector, at selector._domainkey.yourdomain. The selector is chosen by whoever sends your mail, so there is no universal name to look up.
This tool tries the common ones -- default, google, mail, selector1 and selector2 -- which covers Google Workspace and Microsoft 365. If you sign with a custom selector, no record will be found here even though DKIM is configured correctly. Check your provider's documentation for the selector it uses.
Frequently asked questions
Which record should I add first?
SPF, because it is simplest and takes effect immediately. Then DKIM through your mail provider, then DMARC at p=none once both are in place and passing.
Can I have two SPF records?
No. A domain must publish exactly one, and having two causes a permerror that fails every check. Merge them into a single record with multiple include: mechanisms.
Does DMARC stop people spoofing my domain?
At p=reject it stops receivers accepting mail that fails authentication while claiming to be from your domain. It cannot stop someone registering a lookalike domain, which is a separate problem.
Why is my mail still going to spam with all three passing?
Authentication proves who sent a message, not that recipients want it. Large providers also weigh complaint rates, engagement and sending-IP reputation, none of which SPF, DKIM or DMARC address.