MX
Where mail goes
The MX record tells the world which servers receive mail for your domain. Without it, replies have nowhere to land.
Email infrastructure, explained
Email that actually reaches the inbox.
Before a message reaches anyone, the receiving server checks a few public DNS records. Those records decide whether your email is trusted, delayed, or sent to spam.
0
domains scanned in our audit
0%
had at least one email-authentication gap
0
without a DMARC policy that blocks spoofing
01 · The records
Four records. One reputation.
Email infrastructure is a set of DNS records published for your domain. Each one answers a question the receiving server is asking.
SPF
Who may send
SPF is a TXT record listing the servers allowed to send for your domain. Receivers compare the sending server against that list.
DKIM
Proof it wasn't changed
Outgoing mail is signed with a private key. The public key sits in DNS, so anyone can verify the signature.
DMARC
What to do when checks fail
DMARC ties SPF and DKIM to the visible From address and tells receivers to monitor, quarantine, or reject failures.
02 · The delivery
The half-second before delivery.
Tap each stop to see what the receiving server looks at.
-
Your mail client hands the message to an outgoing server, which signs it with your DKIM key.
-
It fetches your SPF, DKIM and DMARC records. A missing or broken record leaves it guessing.
-
Sending server, signature and From address are compared. Passing all three builds trust.
-
Reputation, content and engagement history push the message one way or the other.
03 · Why email lands in spam
Usually more than one small thing.
Spam filtering is a score, not a switch. These are the causes we see most often.
Missing authentication
No SPF, DKIM or DMARC gives receivers nothing to verify. Many mailbox providers now require them from bulk senders.
Broken SPF records
Two SPF records, or more than ten DNS lookups, make the check fail as an error. Legitimate mail gets treated as suspicious.
DMARC on monitor-only
p=none reports spoofing but doesn't stop it, so anyone can send mail that appears to come from your domain.
Complaints and bounces
High spam-complaint or bounce rates, usually from old or purchased lists, damage sender reputation quickly.
A new, unwarmed domain
Sending large volumes from a domain with no history looks like a spam run. Volume should ramp up gradually.
Content and links
Image-only messages, link shorteners and aggressive wording can raise scores. They rarely cause spam on their own.
04 · Our audit
What we found in 2,088 domains.
We checked the public DNS records of small US businesses that send email through Google Workspace or Microsoft 365. This is a sample, not a census, and a flagged record is a configuration finding rather than proof of spam placement.
70%
flagged at least once
1,469 domains had one or more authentication issues.
38
with multiple SPF records
Mail servers treat more than one SPF record as an error.
653
rated critical
Missing or invalid DMARC on a domain that sends email.
05 · Check it yourself
Three commands. Two minutes.
Run these in Terminal, replacing example.com with your domain. Any public DNS lookup tool shows the same records.
SPF
dig +short TXT example.comLook for exactly one line starting with v=spf1.
DMARC
dig +short TXT _dmarc.example.comLook for p=quarantine or p=reject. p=none is monitoring only.
MX
dig +short MX example.comThese are the servers that receive mail for your domain.
Good email is a quiet system.
When the records are right, nobody notices. When they're wrong, customers do.
Email us your domain