Implementation Guides·Updated 2025-07-01·7 min read

How to Verify Your DNS Configuration

Complete guide to verifying SPF, DKIM, DMARC, and MX records after DNS setup — tools, step-by-step checks, common issues, and troubleshooting guide.

Quick Answer

Use MXToolbox to verify each record type, send a test email to mail-tester.com to check authentication, and verify Google Postmaster Tools for ongoing monitoring. Wait 24–48 hours after adding records before testing.

Verification Tools
Verification Steps
Verifying SPF
Verifying DKIM
Verifying DMARC
Full Email Authentication Test
Troubleshooting Common Issues

Introduction

After configuring SPF, DKIM, DMARC, and MX records, you need to verify everything is working before starting warmup. DNS changes can take 24–48 hours to propagate, and misconfigured records are a common cause of deliverability problems.

This guide covers how to verify each record type, what tools to use, and how to troubleshoot common issues.

Who This Guide Is For

• Anyone who has just configured DNS records for cold email
• People whose emails are failing authentication checks
• Teams troubleshooting deliverability issues related to DNS

Key Takeaways

1. Wait 24–48 hours after DNS changes before verifying
2. Use MXToolbox for record lookups and mail-tester.com for email testing
3. Verify SPF, DKIM, DMARC, and MX records individually
4. Common issues: wrong record values, exceeded SPF lookups, DKIM not enabled
5. Set up Google Postmaster Tools for ongoing monitoring

Verification Tools

Tool	What It Checks	URL
MXToolbox	Individual DNS records (SPF, DKIM, DMARC, MX)	mxtoolbox.com
mail-tester.com	Full email authentication from a sent test email	mail-tester.com
Google Admin Toolbox	DNS records and email configuration	toolbox.googleapps.com
Google Postmaster Tools	Gmail-specific reputation and authentication	postmaster.google.com

Verification Steps

Wait 24–48 hours after adding DNS records
Check SPF at MXToolbox SPF Lookup
Check DKIM at MXToolbox DKIM Lookup (enter selector: google for Google Workspace)
Check DMARC at MXToolbox DMARC Lookup
Check MX record at MXToolbox MX Lookup
Send a test email to mail-tester.com and review the full report
Set up Google Postmaster Tools for ongoing monitoring

Verifying SPF

Go to mxtoolbox.com/SPFRecordLookup.aspx
Enter your domain name
Verify the SPF record is found
Check that the record starts with v=spf1
Verify the lookup count is under 10
Check that your email provider's include is listed

⚠️ Warning

If SPF shows 'No SPF Record Found' after 48 hours, check that the TXT record was added at the root domain (@), not at a subdomain.

Verifying DKIM

Go to mxtoolbox.com/DKIMLookup.aspx
Enter your domain and the selector (google for Google Workspace, selector1 for Microsoft 365)
Verify the DKIM record is found
Check that the public key is valid
For Google Workspace: verify 'Start authentication' is enabled in the admin console

ℹ️ Info

If DKIM record is not found, double-check the selector name. Google uses 'google' (google._domainkey.yourdomain.com). Microsoft uses 'selector1' and 'selector2'.

Verifying DMARC

Go to mxtoolbox.com/DMARCLookup.aspx
Enter your domain name
Verify the DMARC record is found at _dmarc.yourdomain.com
Check that the record starts with v=DMARC1
Verify the policy is set (p=none for monitoring)
Check that the rua tag points to a valid email address

Full Email Authentication Test

Individual record checks verify the records exist. The mail-tester.com test verifies that your email actually passes authentication when sent.

Go to mail-tester.com
Copy the unique email address shown
Send a plain text email from one of your cold email mailboxes
Click 'Check your score' on mail-tester.com
Review the SPF, DKIM, and DMARC results
A score of 9/10 or 10/10 indicates proper authentication

📝 Example

mail-tester.com results page showing 9/10 score with green checkmarks for SPF, DKIM, and DMARC.

Troubleshooting Common Issues

Issue	Likely Cause	Fix
SPF record not found	Record added at subdomain instead of root	Move TXT record to @ (root domain)
SPF PermError	More than 10 DNS lookups	Flatten SPF or remove includes
DKIM record not found	Wrong selector or not propagated	Check selector name, wait 48h
DKIM fails at mail-tester	Start authentication not enabled (Google)	Enable in admin console
DMARC not found	Record at wrong hostname	Verify record is at _dmarc.yourdomain.com
MX record missing	MX record not configured	Add MX record from email provider

Best Practices

✓ Wait 24–48 hours after DNS changes before testing
✓ Verify each record type individually at MXToolbox
✓ Send a test email to mail-tester.com for full authentication check
✓ Set up Google Postmaster Tools for ongoing monitoring
✓ Re-verify after any DNS changes

Mistakes to Avoid

✗ Testing immediately after adding DNS records
✗ Only checking one record type and assuming the rest work
✗ Not using mail-tester.com for end-to-end testing
✗ Ignoring Google Postmaster Tools data

Expert Tips

★ mail-tester.com is the single most useful tool — it tests everything in one shot
★ If all records pass at MXToolbox but fail at mail-tester.com, the issue is likely propagation delay
★ Set up Google Postmaster Tools now — you will need it for ongoing monitoring
★ Re-run verification every month to catch any DNS changes or issues

DNS Verification Checklist

☐ SPF record found and valid at MXToolbox
☐ SPF lookup count under 10
☐ DKIM record found at correct selector
☐ DKIM start authentication enabled (Google Workspace)
☐ DMARC record found at _dmarc.yourdomain.com
☐ DMARC policy set to p=none
☐ MX record points to email provider
☐ Test email scores 9/10+ at mail-tester.com
☐ Google Postmaster Tools configured

Summary

DNS verification is a critical step between configuration and warmup. Use MXToolbox to check each record type individually and mail-tester.com to verify full authentication from a sent email.

Common issues include wrong record placement, exceeded SPF lookups, and DKIM not being enabled in the admin console. Most issues resolve with correct DNS values and patience for propagation.

After verification, set up Google Postmaster Tools for ongoing monitoring. Then proceed to domain warmup.

Frequently Asked Questions

How long should I wait before testing DNS records?

Wait at least 24–48 hours after adding records. Most DNS changes propagate within a few hours, but some registrars take longer. If records are not showing after 48 hours, check that they were saved correctly.

What score should I get at mail-tester.com?

9/10 or 10/10 indicates proper authentication. Below 8/10 suggests issues with SPF, DKIM, or DMARC that need investigation.

What if records pass at MXToolbox but fail at mail-tester.com?

This usually means the receiving server's DNS resolver has not yet picked up your changes. Wait another 24 hours and test again.