Troubleshooting Email Authentication Issues

You will find here all the information you need to troubleshoot issues with SPF, DKIM and DMARC.

A variety of tools exist to help you check if your emails are correctly authenticated.

Send a Test Email

Send a test email from your subdomain and then check the email headers.

Most mailbox providers will indicate whether your email is correctly authenticated. For example, in Gmail, open the email, click the three dots in the top right corner, and select "Show Original."

Use a DNS Debug Tool

You can also use dedicated DNS debug tools like EmailStruff's DNS tool.

→ SPF:

• Strict alignment: Type your subdomain name in the TXT field of the tool (subdomain.domain.com)

• Relaxed alignment: Type your bounce subdomain name in the TXT field of the tool (bounce.subdomain.domain.com)

→ DKIM

Type the selector + your subdomain name in the TXT field of the tool (scphxxxx._domainkey.subdomain.domain.fr).

→ DMARC

Type _dmarc.subdomain.domain.com in the TXT field of the tool to check your DMARC record.

Dig Command

Alternatively, you can use the dig command following the same logic:

dig TXT subdomain.domain.com

Common Issues with Strict Alignment

When operating in strict alignment mode, the presence of TXT entries within the same domain often disrupts email authentication.

The most frequent cause is a Google Postmaster Tools verification code being incorrectly placed at the subdomain level. Ensure that you only verify your root domain with Google Postmaster Tools.

Subsequent subdomains do not require individual verification to be added to the tool's monitoring.