Articles on: Security Scan

Sender Authentication Explained: SPF, DKIM and DMARC Results

SPF, DKIM and DMARC make it hard for attackers to send e-mails in your name. AutoPhish checks these records for every verified domain and tells you what to fix. This article explains where you find the results, what they mean and how to resolve the most common issues.


What AutoPhish checks


  • SPF – which servers may send e-mail for your domain
  • DKIM – whether outgoing e-mails can be signed and verified
  • DMARC – what receivers should do with e-mails that fail SPF or DKIM, and where reports are sent
  • Mail posture – whether the domain receives and sends e-mail, based on its MX and other records


The check runs once a day for every verified domain with monitoring switched on. Admins can also start it with Check email sending DNS on the domain page.


Where you find the results


Email Sender Authentication tab with SPF, DKIM and DMARC status and recommendations



  • Security → Domains → open a domain → tab Email Sender Authentication: the published SPF, DKIM and DMARC records with their status, a numbered list of Recommendations and the Sender authentication check history.
  • Security → Issues → tab Sender authentication issues: all open problems of your domains in one list.
  • The Security Center PDF report contains a section on sender authentication.


The domain status is Healthy, Warning, Critical or Not assessed. It is Critical if SPF, DKIM or DMARC fails, if both SPF and DMARC are missing, or if the domain should receive e-mail but has no working mail destination.


Issue severity


Result

Severity in the issue list

SPF or DMARC failed

High

DKIM failed

Medium

Warning for SPF, DKIM or DMARC

Medium

Record missing

Low


A single missing record is listed as Low, but if both SPF and DMARC are missing, the domain is Critical. Add the missing records first.


Common issues and how to fix them


SPF


Issue

What to do

No SPF record found

Publish a TXT record that lists your mail servers, ending with ~all or -all, for example v=spf1 include:spf.protection.outlook.com -all.

SPF allows anyone to send (+all)

Change +all to -all or ~all immediately.

Neutral policy (?all)

Change it to ~all or -all.

Too many DNS lookups (more than 10)

Remove unused include: entries or combine them.

Record longer than 255 characters

Shorten the record, for example by removing unused entries.

Domain does not send e-mail

Publish v=spf1 -all.


DKIM


AutoPhish looks for DKIM keys under the common selectors of the large mail providers. If your provider uses its own selector, add it under DKIM Selectors in the domain's Settings tab (up to 20 selectors).


Issue

What to do

No DKIM records found

Switch on DKIM signing at your mail provider and publish the key, or add your custom selector.

Key revoked (empty public key)

Publish a valid key or remove the old selector at your provider.

Missing version tag (v=DKIM1) or public key

Correct the published record as your provider shows it.


If your domain does not send e-mail, set Outbound mail use to Disabled in the domain's Settings tab. DKIM is then shown as not applicable.


DMARC


Issue

What to do

No DMARC record found

Publish a TXT record at _dmarc.yourdomain, for example v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@yourdomain.

Policy none

Review the reports, then raise the policy to quarantine or reject.

No report address (rua=)

Add an address that receives aggregate reports.

No subdomain policy (sp=)

Add sp= with the same policy as p=.

Policy applies to less than 100 % of e-mails (pct=)

Raise pct to 100 or remove it.

Missing policy (p=)

Add p=none, p=quarantine or p=reject.


p=reject passes if it has a report address. p=quarantine passes if it also has a subdomain policy. Subdomains without their own DMARC record use the record of the main domain; AutoPhish then shows "Inherited from _dmarc.…".


Mail posture


  • No MX record: if the domain receives e-mail, publish explicit MX records.
  • Domain does not receive e-mail: publish a null MX record (MX 0 .).


You can set Inbound mail use and Outbound mail use in the domain's Settings tab to Automatic (record inference), Enabled or Disabled. Automatic works out the use from the published records. Changes apply from the next check.


After a fix


DNS changes can take a while to spread. Click Check email sending DNS on the domain page to check again; resolved issues disappear from the list.


Alerts


When the daily check detects a change – for example a new or removed record, a changed DMARC policy or a new status – all company admins receive an e-mail alert. You can switch alerts off per domain with Email Alerts in the domain's Settings tab. The manual check does not send alerts.

Updated on: 28/10/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!