Most domain owners have never verified whether their SPF, DKIM, DMARC, and DNSSEC records are actually configured correctly, since these records quietly fail or go missing without any obvious symptom until email delivery or security suddenly becomes a problem. This checklist runs through each one systematically, starting with a full record pull from a free dns lookup.
Step 1: Confirm SPF Is Present and Correctly Scoped
SPF, Sender Policy Framework, specifies which mail servers are authorized to send email on a domain’s behalf. Check your domain’s current SPF record with a free dns lookup and confirm it includes every legitimate sending service you actually use, since an incomplete SPF record can cause legitimate email to be flagged as spam.
Step 2: Confirm DKIM Signing Is Active
DKIM adds a cryptographic signature to outgoing email, verifying the message genuinely originated from an authorized sender and was not altered in transit. Confirm your specific email provider’s DKIM setup is active and that the corresponding DNS record is published correctly.
Step 3: Confirm DMARC Policy Is Set to Enforce, Not Just Monitor
DMARC tells receiving mail servers exactly how to handle messages that fail SPF or DKIM checks, and many domains publish a DMARC record set only to monitoring mode, meaning it collects data without actually enforcing any policy. Confirm your DMARC record’s policy tag reflects the actual enforcement level you intend.
| Record | What It Verifies | Common Failure |
| SPF | Authorized sending servers | Missing a legitimate sending service |
| DKIM | Message signature authenticity | Signing key not properly published |
| DMARC | Enforcement policy for failed checks | Left in monitor-only mode indefinitely |
| DNSSEC | Cryptographic validation of DNS responses | Never enabled at all |
Step 4: Confirm DNSSEC Is Enabled
DNSSEC adds cryptographic validation to DNS responses themselves, protecting against DNS spoofing attacks where a malicious actor attempts to redirect traffic through falsified DNS responses. Many domains never enable this protection simply because it requires an explicit setup step their registrar does not enable by default.
Step 5: Cross-Reference Against Your Actual Hosting Setup
Confirming the IP address your domain’s A record points to with an ip lookup ensures your broader DNS health check aligns with where your site and email infrastructure actually live, rather than auditing records in isolation from your actual current hosting reality.
Step 6: Confirm Overall Site Performance Is Not Masking a DNS Issue
Running a page speed checker alongside this DNS health check helps distinguish a genuine DNS misconfiguration from an unrelated server performance issue that might otherwise be mistaken for a DNS problem.
Running This Checklist on a Recurring Schedule
DNS and email authentication records can silently drift out of correct configuration after a provider change or team transition, so repeating this full checklist quarterly, using the same free tools page each time, rather than only after something visibly breaks, catches these gaps proactively.
Every tool referenced throughout this checklist is available through WritoryBuzz’s free DNS toolkit.
