How does the SPF, DKIM, and DMARC checker inspect your domain's live DNS email authentication records?
Enter the bare domain and run the check. WebJi® queries four TXT names and returns the records it found. A row marked lookup failed means the query did not succeed, so the tool will not call that row present or passed. An empty success means the name answered and the record is missing.
| Check | DNS name | What counts as present |
|---|---|---|
| SPF | the domain | A TXT that starts with v=spf1. Other TXT records are ignored. |
| DMARC | _dmarc.domain | A TXT that starts with v=DMARC1. |
| DKIM | selector1._domainkey.domain | Any TXT on that name. A key-shaped record is noted, not certified. |
| DKIM | google._domainkey.domain | Any TXT on that name. Other selectors are not queried. |
How do you read your SPF lookup count, DKIM public-key status, and DMARC policy (none, quarantine, reject)?
SPF starts with v=spf1. Count include, a, mx, ptr, exists, and redirect in that text as a hint, not a full nested lookup. DKIM here is present only when a TXT came back on these selectors. DMARC starts with v=DMARC1, and p= is none, quarantine, or reject. The what DKIM is guide explains the signature.
- The SPF number counts mechanisms written in the record. It does not follow nested includes.
- More than 10 mechanisms in the text is a warning, not a completed PermError test.
- DKIM is “TXT found” or “no TXT”. A missing p= value is not called a valid key.
- Read p=none, p=quarantine, or p=reject from the DMARC text. Alignment is not checked.
How do you fix 'SPF PermError: too many DNS lookups', missing DKIM selectors, or a missing _dmarc TXT record?
If SPF is missing, publish one TXT that names only the servers that send your mail. If it already has many includes, remove unused ones before you add another. If DKIM is missing, turn signing on at the mail host. If _dmarc is missing, add a TXT. Follow the SPF and DMARC setup guide.
- Keep a single SPF TXT. Two records that both start with v=spf1 are a problem of their own.
- Remove include, a, mx, ptr, exists, and redirect terms you no longer send from.
- Publish the selector your mail host shows you. This checker only looks at selector1 and google.
- Add _dmarc as a TXT on that exact name, then run the check again. A failed lookup is not a fix.
What extra steps improve inbox placement with Gmail, Outlook, and corporate mail gateways?
Gmail, Outlook, and company gateways check that SPF, DKIM, and DMARC align before the inbox. A record that exists is not the same as mail that aligns. Keep the sending domain and the visible from domain on mail you control. Use business email hosting in India if you need the mailbox product.
- Send only from hosts named in SPF, and sign that same domain with DKIM.
- Start DMARC at p=none while you read reports, then tighten it when the mail is aligned.
- A gateway can still folder mail that authenticates. Authentication is not a placement promise.
- Email support@webji.services if a row says lookup failed and you need it read with you.