Email DNS records explained: what each one does
Four DNS records decide whether your email is delivered and trusted, and a fifth helps your IP look legitimate. The email DNS checker above reviews MX, SPF, DKIM and DMARC in one lookup. This table shows what each record does and where it usually breaks.
| Record | What it does | Where it lives | Typical error |
|---|---|---|---|
| MX | Receives mail for your domain | yourdomain.com | Missing, or still pointing to an old provider |
| SPF | Lists servers allowed to send for you | TXT on yourdomain.com | Over 10 DNS lookups, two records |
| DKIM | Signs each message | TXT at selector._domainkey | Signing never switched on |
| DMARC | Tells receivers what to do when checks fail | TXT at _dmarc | Stuck at p=none, no reports |
| PTR (rDNS) | Maps your sending IP back to a hostname | Set by your IP owner | Missing on self-hosted servers |
What DNS records you need to send email
Every domain that sends mail needs SPF and DKIM, and Gmail and Yahoo require a DMARC record from anyone sending 5,000 or more messages a day to their users. MX is needed to receive replies and bounces. If you send through Google Workspace, Microsoft 365 or a major email platform, the provider manages the PTR record for its IPs. If you run your own server, you have to ask your hosting provider to set it. More on that in why PTR records matter for deliverability.
The order to set up email authentication
Start with MX so the domain can receive mail. Add one SPF record that covers every service sending as you. Turn on DKIM signing in each of those services and publish their keys. Publish DMARC with p=none and a rua address so reports start coming in. Once the reports show every legitimate sender passing, move the policy to quarantine and then reject. The SPF, DKIM and DMARC checkers go deeper into each step.
If the checker can't find DKIM while your provider says it's on, the key is probably published under a custom selector. Look up the s= value in the headers of a sent message and check it in the DKIM Checker directly.
DNS changes and propagation
Changes don't show everywhere at once. Each record has a TTL, the time other servers may keep the old value cached, often between five minutes and a day. If a new record doesn't appear here, wait for the old TTL to pass and check again. Our article on DNS propagation explains how to plan changes around it.
Next step when all records pass
Passing records prove to receivers who you are. Where your mail lands from here depends on reputation, engagement and content, so run a free Email Deliverability Test to see the result at Gmail, Outlook and Yahoo. Warmy then builds that reputation with warm-up from real mailboxes and re-checks your DNS every day.
Records all green? Let Warmy build your inbox reputation. Try it free for 7 days or book a demo.

























