With Outlook.com bouncing mail from domains with weak SPF or no DMARC, I checked every domain I send mail from. You only need dig. Swap example.com for your own domain.
1. SPF
dig +short TXT example.com | grep -i "v=spf1"You want exactly one record starting with v=spf1 and ending in ~all or -all. Two SPF records is an error, and so is going over 10 DNS lookups (each include: counts).
2. DKIM
dig +short TXT selector._domainkey.example.comYour mail provider tells you the selector name (look in its DNS setup page or in a sent message’s DKIM-Signature: s= header). You should get back a v=DKIM1; k=rsa; p=... record.
3. DMARC
dig +short TXT _dmarc.example.comNo answer means no DMARC. A safe starting record is:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comWatch the reports for a couple of weeks, then move to p=quarantine and later p=reject.
4. Test a real message
Send yourself a mail at a big provider, open the headers, and look for spf=pass, dkim=pass and dmarc=pass in Authentication-Results.
Domains that never send mail should still get v=spf1 -all and p=reject so nobody can spoof them.
God Bless, and Use the Source!
