Wiki· Updated 17 Oct 2026
Email: SPF, DKIM, DMARC, PTR
Why a domain's mail lands in spam or is rejected, and how to fix it in DNS.
A receiver trusts a message when the sender's domain vouches for it with three DNS records, and the server's IP with a reverse record:
| Record | What it proves |
|---|---|
| SPF | which servers may send mail for the domain |
| DKIM | the message is signed with the domain's key and unchanged |
| DMARC | what to do with mail failing SPF/DKIM, and where to send reports |
| PTR | the server's IP really belongs to its hostname |
Check everything at once with Email DNS Checker. Fixes for each finding are below.
In this section
- SPF: more than 10 DNS lookups (permerror) — how to fixWhy SPF breaks after 10 lookups and how to cut includes without losing senders.
- Multiple SPF records on a domain — how to fixTwo v=spf1 records cause permerror. How to merge them into one.
- DMARC p=none: how to move to quarantine and reject safelyp=none only monitors. A plan to protect the domain from spoofing without losing mail.
- DKIM not found: selector, publishing the key and checkingWhere to find the selector, how to publish the DKIM public key, and why DMARC is fragile without it.
- PTR doesn't match the mail server hostname (FCrDNS)Why a self-hosted SMTP server without proper reverse DNS lands in spam, and how to set it up.