# Troubleshooting Email Authentication Issues

A variety of tools exist to help you check if your emails are correctly authenticated.

## Send a Test Email

Send a test email from your subdomain and then **check the email headers**.

Most mailbox providers will indicate whether your email is correctly authenticated. For example, in Gmail, open the email, click the **three dots** in the top right corner, and select "**Show Original.**"

<figure><img src="https://509463063-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfiAYaWDWqtFZeXxyg67F%2Fuploads%2F3vkWEpubmR5eR0j9xdwU%2Fdeliverability_auth-diag_300925.png?alt=media&#x26;token=65bdcc88-bd63-462e-9764-b2ca20f33963" alt=""><figcaption></figcaption></figure>

## Use a DNS Debug Tool

You can also use dedicated DNS debug tools like [EmailStruff's DNS tool](https://emailstuff.org/dns).

#### → SPF:

* **Strict alignment**: Type your subdomain name in the TXT field of the tool (`subdomain.domain.com`)
* **Relaxed** **alignment**: Type your bounce subdomain name in the TXT field of the tool (`bounce.subdomain.domain.com`)

#### → DKIM

Type the selector + your subdomain name in the TXT field of the tool (`scphxxxx._domainkey.subdomain.domain.fr`).

#### → DMARC

Type `_dmarc.subdomain.domain.com` in the TXT field of the tool to check your DMARC record.

## Dig Command

Alternatively, you can use the `dig` command following the same logic:

```
dig TXT subdomain.domain.com
```

## Common Issues with Strict Alignment

When operating in strict alignment mode, the presence of **TXT entries** within the same domain **often disrupts email authentication**.

The most frequent cause is a **Google Postmaster Tools** verification code being incorrectly placed at the subdomain level. Ensure that you only verify your root domain with Google Postmaster Tools.&#x20;

Subsequent subdomains do not require individual verification to be added to the tool's monitoring.