How can you verify a domain’s SPF and DKIM records?

Query the domain’s TXT records and find the single policy beginning with v=spf1. Check that it includes every service authorized to send using that domain and ends with the intended qualifier. Multiple separate SPF policies cause a permanent error; combine authorized sources into one policy while staying within SPF’s DNS lookup limit.

For DKIM, obtain the selector from the email provider or a message header. Query selector._domainkey.example.com and confirm that the public key record exists without accidental hostname duplication or missing characters. The selector is required because a root-domain TXT lookup will not reveal which DKIM name the sender uses.

Send a message to an external mailbox and inspect its full headers. Look for SPF, DKIM, and DMARC results, the signing domain, return-path domain, and alignment with the visible From address. A DNS lookup can confirm publication, while a real message confirms that the sending system uses the expected records.

Allow previous DNS caches to expire after a correction and test again. Use the diagnostic tools supplied by the email provider because they know the required include domains and selectors. Keep old DKIM keys during a documented rotation period, then remove records that no active sender uses.