> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.autophish.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Sender Authentication Explained: SPF, DKIM and DMARC Results

SPF, DKIM and DMARC make it hard for attackers to send e-mails in your name. AutoPhish checks these records for every verified domain and tells you what to fix. This article explains where you find the results, what they mean and how to resolve the most common issues.

## What AutoPhish checks

- **SPF** – which servers may send e-mail for your domain
- **DKIM** – whether outgoing e-mails can be signed and verified
- **DMARC** – what receivers should do with e-mails that fail SPF or DKIM, and where reports are sent
- **Mail posture** – whether the domain receives and sends e-mail, based on its MX and other records

The check runs once a day for every verified domain with monitoring switched on. Admins can also start it with **Check email sending DNS** on the domain page.

## Where you find the results

![Email Sender Authentication tab with SPF, DKIM and DMARC status and recommendations](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/sender-auth_1tgdh6d.jpg)


- **Security → Domains** → open a domain → tab **Email Sender Authentication**: the published SPF, DKIM and DMARC records with their status, a numbered list of **Recommendations** and the **Sender authentication check history**.
- **Security → Issues** → tab **Sender authentication issues**: all open problems of your domains in one list.
- The Security Center PDF report contains a section on sender authentication.

The domain status is **Healthy**, **Warning**, **Critical** or **Not assessed**. It is Critical if SPF, DKIM or DMARC fails, if both SPF and DMARC are missing, or if the domain should receive e-mail but has no working mail destination.

## Issue severity

| Result | Severity in the issue list |
| ---- | ---- |
| SPF or DMARC failed | High |
| DKIM failed | Medium |
| Warning for SPF, DKIM or DMARC | Medium |
| Record missing | Low |

A single missing record is listed as Low, but if both SPF and DMARC are missing, the domain is Critical. Add the missing records first.

## Common issues and how to fix them

### SPF

| Issue | What to do |
| ---- | ---- |
| No SPF record found | Publish a TXT record that lists your mail servers, ending with `~all` or `-all`, for example `v=spf1 include:spf.protection.outlook.com -all`. |
| SPF allows anyone to send (`+all`) | Change `+all` to `-all` or `~all` immediately. |
| Neutral policy (`?all`) | Change it to `~all` or `-all`. |
| Too many DNS lookups (more than 10) | Remove unused `include:` entries or combine them. |
| Record longer than 255 characters | Shorten the record, for example by removing unused entries. |
| Domain does not send e-mail | Publish `v=spf1 -all`. |

### DKIM

AutoPhish looks for DKIM keys under the common selectors of the large mail providers. If your provider uses its own selector, add it under **DKIM Selectors** in the domain's **Settings** tab (up to 20 selectors).

| Issue | What to do |
| ---- | ---- |
| No DKIM records found | Switch on DKIM signing at your mail provider and publish the key, or add your custom selector. |
| Key revoked (empty public key) | Publish a valid key or remove the old selector at your provider. |
| Missing version tag (`v=DKIM1`) or public key | Correct the published record as your provider shows it. |

If your domain does not send e-mail, set **Outbound mail use** to **Disabled** in the domain's **Settings** tab. DKIM is then shown as not applicable.

### DMARC

| Issue | What to do |
| ---- | ---- |
| No DMARC record found | Publish a TXT record at `_dmarc.yourdomain`, for example `v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@yourdomain`. |
| Policy `none` | Review the reports, then raise the policy to `quarantine` or `reject`. |
| No report address (`rua=`) | Add an address that receives aggregate reports. |
| No subdomain policy (`sp=`) | Add `sp=` with the same policy as `p=`. |
| Policy applies to less than 100 % of e-mails (`pct=`) | Raise `pct` to 100 or remove it. |
| Missing policy (`p=`) | Add `p=none`, `p=quarantine` or `p=reject`. |

`p=reject` passes if it has a report address. `p=quarantine` passes if it also has a subdomain policy. Subdomains without their own DMARC record use the record of the main domain; AutoPhish then shows "Inherited from \_dmarc.…".

### Mail posture

- **No MX record:** if the domain receives e-mail, publish explicit MX records.
- **Domain does not receive e-mail:** publish a null MX record (`MX 0 .`).

You can set **Inbound mail use** and **Outbound mail use** in the domain's **Settings** tab to **Automatic (record inference)**, **Enabled** or **Disabled**. Automatic works out the use from the published records. Changes apply from the next check.

## After a fix

DNS changes can take a while to spread. Click **Check email sending DNS** on the domain page to check again; resolved issues disappear from the list.

## Alerts

When the daily check detects a change – for example a new or removed record, a changed DMARC policy or a new status – all company admins receive an e-mail alert. You can switch alerts off per domain with **Email Alerts** in the domain's **Settings** tab. The manual check does not send alerts.