Email deliverability
A signature only works if the email carrying it arrives. Deliverability is mostly about three DNS records that let receiving mail servers tell your mail apart from someone forging your domain. This guide explains what they do, how to check yours, and what to fix first.
The three records that matter
- SPF - who is allowed to send
- A DNS record listing the servers permitted to send mail for your domain. If you send through Google Workspace, Microsoft 365, or a marketing platform, each one has to be included. A missing or wrong SPF record is the most common reason legitimate mail lands in spam.
- DKIM - proof it was not tampered with
- Your mail server signs each message with a private key; receivers check the signature against a public key published in your DNS. A valid signature proves the message really came from your domain and was not altered on the way.
- DMARC - what to do when a check fails
- A policy record that tells receivers how to treat mail that fails SPF and DKIM: none (just report), quarantine (send to spam), or reject (refuse outright). It also asks receivers to send you reports, so you can see who is sending as you.
Check your domain
SignNexa's Email Intelligence tool reads your live DNS and grades what it finds. It is free and needs no account.
- 1
Run the check
Enter your domain - the part after the @ in your email address, not the full address - and run the scan.
- 2
Read the authentication results
You get SPF, DKIM, and DMARC each graded on their own, plus MX and mail routing, reverse DNS, blacklist status, and the newer BIMI, MTA-STS, and TLS-RPT records.
- 3
Validate a record before you publish it
The same tool includes SPF and DMARC record validators. Paste a record you are about to add to DNS and check it parses correctly before it goes live - a typo in a published SPF record can stop your mail dead.
Test what actually arrives
A DNS check tells you what your records say. The Inbox Tester tells you what a receiver really sees: send a real email to the address it gives you, and it reports the true SPF, DKIM, and DMARC results for that specific message, including alignment. Use it when the DNS looks right but mail is still going astray - it catches the case where you send through a service that is not covered by your SPF record.
Fix in this order
- 1
Get SPF correct and complete
Make sure every service that sends on your behalf is included, and that you have exactly one SPF record. Two SPF records is an error - receivers treat it as a failure.
- 2
Turn on DKIM signing
Enable DKIM in your mail provider's admin console and publish the DNS record it gives you. Google Workspace and Microsoft 365 both generate it for you.
- 3
Start DMARC at none
Publish a DMARC record with p=none and a reporting address first. Nothing gets blocked, and you start receiving reports showing every source sending as your domain.
- 4
Tighten once the reports are clean
When the reports show only your own legitimate senders passing, move to quarantine, then to reject. Skipping straight to reject before you have read the reports is how real mail gets thrown away.
Where signatures fit in
A SignNexa signature is HTML inside a message your own mail server sends, so it does not change your SPF, DKIM, or DMARC results either way. If your mail is being filtered, the cause is your domain authentication or sending reputation, not the signature. Fix the records first - the signature will arrive with the mail.
Related
Last reviewed: