# SPF, DKIM and DMARC for Your Business Email: What to Check After You Connect Your Domain

Source: https://lotsmail.to/blog/spf-dkim-and-dmarc-for-your-business-email-what-to-check-after-you-connect-your-domain
Published: 2026-11-06T00:30:23.509496+00:00

After you connect your domain to LotsMail, check three things: one SPF record that authorises your senders, DKIM signing that passes, and a DMARC record that exists and is not duplicated. You can confirm all three in a couple of minutes with `dig` or an online checker, and a pass looks like `spf=pass`, `dkim=pass` and `dmarc=pass` on a message you send to yourself.

I'm the founder of LotsMail, and once the records are added the obvious question is "did it work?". The console shows the records and checks your DNS, but it is worth knowing how to look yourself, because Google and Yahoo both now spell out what they expect from the mail they receive.

## Why it matters: what Google and Yahoo say

Both providers publish sender requirements. I opened both pages on 5 November 2026.

**Google**, "Email sender guidelines" ([support.google.com/a/answer/81126](https://support.google.com/a/answer/81126)), checked on 5 November 2026:

- For all senders: "Set up SPF or DKIM email authentication for your sending domains."
- For bulk senders: "Set up SPF and DKIM email authentication for your domain." and "Set up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none."
- "Keep spam rates reported in Postmaster Tools below 0.3%."

**Yahoo**, "Sender Best Practices" ([senders.yahooinc.com/best-practices](https://senders.yahooinc.com/best-practices/)), checked on 5 November 2026:

- All senders: "Implement SPF or DKIM at a minimum".
- Bulk senders: "Implement both SPF & DKIM", and "Publish a valid DMARC policy with at least p=none - DMARC must pass".
- "Ensure the domain in the From: header is aligned with either the SPF domain or the DKIM domain." Yahoo adds that relaxed alignment is acceptable.
- Yahoo "strongly urges all senders to publish a DMARC policy for each domain that sends mail."

Two things to take from that. Authentication is the floor, not a bonus. And `p=none` is explicitly accepted as a starting policy, so you do not have to jump straight to a strict one. Neither page promises inbox placement, and neither do I: correct records put you in good standing, nothing more.

LotsMail is made for everyday business email, not bulk, marketing or cold email, so most owners sit well below the bulk thresholds. The same records still decide whether your quotes and replies look legitimate.

## The records LotsMail asks for

LotsMail lets you keep your DNS provider and your website: you add the records the console shows, then point your mail when you are ready. In the console, open your workspace, then **Domains**, and add the domain. The record set, as described in my [step-by-step custom domain email guide](https://lotsmail.to/blog/how-to-get-custom-domain-email), is:

| Record | Where | What it does |
|---|---|---|
| Verification TXT | `_lotsmail` name, value starting `lotsmail-verification=` | Proves you own the domain. You can delete it once verified. |
| Three CNAMEs | Names and targets copied from the console | DKIM: your mail is signed |
| `bounce` subdomain | One MX record (priority 10) and one SPF TXT record | Bounce reports come back to LotsMail |
| DMARC TXT | `_dmarc`, starting at `p=none` | Only if your domain has no DMARC record yet |

Two details matter for the checks below. The SPF record for LotsMail sending lives on the `bounce` subdomain, so you do not edit your main domain's SPF for it. And if you already have a DMARC record, you keep it. Always copy names and values from the console rather than from this table: the DKIM names and tokens are yours alone. LotsMail's changelog also lists plain help for each DNS record in the Domains page (support.lotsmail.to/changelog, checked 5 November 2026).

## Check SPF

SPF is a TXT record that starts with `v=spf1`. Run this for your own domain:

```
dig +short TXT yourdomain.com
```

What you want: exactly one line that starts with `v=spf1`, listing every service that sends as your domain. A healthy example looks like this (an illustration with example.com, not your values):

```
"v=spf1 include:_spf.example-provider.com ~all"
```

For the LotsMail bounce subdomain, check that one too:

```
dig +short TXT bounce.yourdomain.com
dig +short MX bounce.yourdomain.com
```

You should see a `v=spf1` TXT answer and an MX answer with priority 10. No answer means the record is missing, has a typo, or has not propagated yet.

## Check DKIM

DKIM records are CNAMEs. The console shows the exact names, so look each one up with `dig`:

```
dig +short CNAME <name-from-the-console>.yourdomain.com
```

A pass at this stage is an answer that matches the target the console shows. If you use Cloudflare, set the CNAME records to DNS only, not proxied, or the lookup will not return the target. The real proof comes from a message: send one from your LotsMail address to an inbox you own, open the original message source, and look at the `Authentication-Results` header. You want `dkim=pass` next to your domain.

## Check DMARC

```
dig +short TXT _dmarc.yourdomain.com
```

A pass is one record that starts with `v=DMARC1;` and has a `p=` policy, for example:

```
"v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"
```

DMARC passes when SPF or DKIM passes **and** the domain it passes for matches the domain in your From address. That is the alignment point Yahoo spells out above. In the same `Authentication-Results` header, look for `dmarc=pass`.

## Online checkers

If you prefer a web page, use any DMARC, SPF and DKIM lookup tool: enter your domain, and for DKIM enter the exact selector name from the console. Treat the tool as a second opinion for the same DNS answers `dig` gives you.

## Common mistakes

**Two SPF records.** A domain should have a single SPF record. If you have added a second one for another service, the receiver may treat SPF as an error. Merge them into one line with several `include:` entries. Check with the `dig +short TXT yourdomain.com` command above and count the `v=spf1` lines.

**Two DMARC records.** Keep one. If the console finds more than one, it tells you which to keep.

**A DKIM CNAME that is proxied.** Cloudflare's orange cloud hides the target. Switch those records to DNS only.

**Typos from copying.** DNS hosts differ in whether they want the full name or just the part before your domain. If your host appends the domain for you, do not paste it twice.

**Judging too early.** DNS changes can take time to reach every resolver. Re-run the lookup after a few minutes before you change anything.

**Changing MX too soon.** Create every address you use first, then point your mail. Keep the old account open for a couple of days after switching, because some senders take a while to catch up.

## DMARC policy: p=none vs quarantine

`p=none` means "monitor only": receivers do not act on a failure, and reports tell you who sends as your domain. `p=quarantine` asks receivers to treat failures as suspicious, usually the spam folder. `p=reject` asks them to refuse the message. Google and Yahoo both accept `p=none` as the minimum for bulk senders (quotes above).

The safe order is the one most guides use: start at `p=none`, read the reports for a week or two to catch forgotten senders like a website form or an invoicing tool, then move to `quarantine` once every legitimate sender passes. Moving too early is how real mail ends up in spam. The DMARC record the console prepares starts at `p=none`.

## What the LotsMail dashboard shows

From the live site and help pages checked on 5 November 2026: you add the records the console shows and point your mail to LotsMail when you are ready. The Domains page shows your domain, and a domain starts counting the day its ownership is verified, not the day you add it. A new domain can send up to 100 emails a day for its first 14 days, and after that it sends up to its monthly allowance. For every send, LotsMail shows delivery status per recipient: delivered, bounced or delayed. If you use ChatGPT or Claude with your mailbox, they can fetch setup steps, but changing DNS is always done by you in the dashboard.

Each domain is one unit: unlimited mailboxes and people, 10 GB of shared storage and 1,000 sent emails a month. Starter is $5 a month for one domain; see the [pricing page](https://lotsmail.to/pricing) and [pricing explained](https://lotsmail.to/blog/lotsmail-pricing-explained) for the rest.

## A five-minute checklist

1. `dig +short TXT yourdomain.com`: one `v=spf1` line.
2. `dig +short TXT bounce.yourdomain.com` and MX: both answer.
3. `dig +short CNAME` on each DKIM name from the console: targets match.
4. `dig +short TXT _dmarc.yourdomain.com`: one `v=DMARC1` record.
5. Send a message to yourself and read `Authentication-Results`: `spf=pass`, `dkim=pass`, `dmarc=pass`.

If something fails, [LotsMail's help](https://lotsmail.to/help) and the contact link there reach me. For why mail can still miss an inbox, and what to do about forwarding versus a real mailbox, see [email forwarding or a real mailbox](https://lotsmail.to/blog/email-forwarding-or-real-mailbox). For how LotsMail handles safety, see [is LotsMail safe](https://lotsmail.to/blog/is-lotsmail-safe). If you restrict a mailbox to listed senders, their own SPF, DKIM and DMARC matter too: [restricted mailboxes explained](https://lotsmail.to/blog/restricted-mailboxes-explained).

## FAQ

### Do I need SPF, DKIM and DMARC for a small business domain?

Google asks all senders for SPF or DKIM and bulk senders for all three; Yahoo asks for SPF or DKIM at a minimum and both for bulk senders (both pages checked on 5 November 2026). Setting up all three is the simplest way to stay on the right side of both.

### Can I have two SPF records?

No. A domain should have one SPF record. Merge the includes from each service into a single `v=spf1` line.

### Is DMARC p=none enough?

For the requirements above, yes: Google says the enforcement policy "can be set to none" and Yahoo asks for "at least p=none". It only monitors, though. Move to quarantine once your reports show every legitimate sender passing.

### How do I check if SPF, DKIM and DMARC pass?

Run `dig +short TXT` on your domain and on `_dmarc.yourdomain.com`, look up each DKIM CNAME the console shows, then send yourself a message and read the `Authentication-Results` header for `spf=pass`, `dkim=pass` and `dmarc=pass`.

### Does LotsMail change my main domain's SPF record?

The LotsMail SPF record is published on the `bounce` subdomain, so you do not edit your main domain's SPF for it. If other services send as your domain, keep their includes in the one SPF record you already have.

### Will correct records guarantee inbox delivery?

No sender can promise that. Correct records are the baseline Google and Yahoo expect; content, reputation and recipient settings do the rest.

## Sources, checked on 5 November 2026

- Google, Email sender guidelines: https://support.google.com/a/answer/81126
- Yahoo, Sender Best Practices: https://senders.yahooinc.com/best-practices/
- LotsMail help, pricing, changelog: https://lotsmail.to/help, https://lotsmail.to/pricing, https://support.lotsmail.to/changelog