Should I set SPF or DMARC first?

Get SPF and DKIM working first. DMARC depends on those signals, so adding DMARC before basic authentication is stable usually creates weak or misleading policy outcomes.

Why do I still miss incoming mail even though MX exists?

The MX target may not have a valid A/AAAA record, the mail server may not be reachable on the required ports, or the provider-side service may be inactive.

Will missing DKIM always stop mail delivery?

Not always, but it reduces trust and makes spam placement more likely. It also weakens DMARC alignment.

MX/SPF/DMARC Basic Checks

A baseline email diagnostics guide for separating mail delivery, spam classification, and authentication issues across MX, SPF, DMARC, and DKIM.

Diagnose your site now

Problem

Email is not arriving, outgoing mail is landing in spam, or authentication checks are incomplete. These incidents usually involve multiple records and delivery paths rather than a single missing entry.

Symptoms

Incoming mail is delayed, missing, or bounced.
Outgoing mail lands in spam instead of the inbox.
Email Check reports missing SPF, DMARC, or DKIM.
The mail host exists, but external connectivity on mail-related ports is unreliable.

Top 3 Causes

Missing inbound route - MX is missing or its target host does not resolve correctly.
Missing sender authentication - SPF, DKIM, or DMARC is absent or misconfigured.
Operational path issue - Mail ports are blocked, provider include chains are wrong, or policy values are outdated.

Diagnose with DechoNet

Email Check to inspect MX, SPF, DMARC, DKIM, and reverse DNS in one pass.
DNS Lookup to verify the actual MX target and TXT record responses directly.
Port Check to confirm whether the mail server is reachable from the outside.

Resolution Checklist

Verify that MX exists and points to the correct host with the intended priority.
Confirm the MX target has valid A or AAAA records.
Make sure only one SPF TXT record exists and that its include chain is not excessive.
Start DMARC with p=none, review reports, then tighten to quarantine or reject when alignment is stable.
Confirm the DKIM selector matches the current mail provider configuration.
Re-run Email Check after changes to verify that missing signals are resolved.

When to Escalate

Escalate to the provider if you use managed email platforms such as Google Workspace, Microsoft 365, or SES.
Escalate if SPF includes or DKIM selectors are controlled by a vendor you cannot modify directly.
Escalate to your network or hosting team if mail delivery depends on ports or firewall rules you do not control.