If your emails are being quarantined, blocked, or flagged as spam, the most common cause is a misconfigured or missing email authentication record on your domain. This article explains what SPF, DKIM, and DMARC are, how to check whether they're set up correctly, and how to fix the most common issues.
BoomTown configures authentication on its own dedicated sending domain automatically — no action needed on your end for that. This article applies when emails sent from your own custom domain (e.g., your personal or company email address) are being blocked or rejected.
What are SPF, DKIM, and DMARC?
These are DNS records that prove to receiving email servers that your messages are legitimate and authorized to be sent from your domain. Without them, many email providers will quarantine or reject your messages.
Record | What it does | DNS record type |
SPF | Lists which mail servers are authorized to send email on behalf of your domain. | TXT |
DKIM | Adds a cryptographic signature to outgoing emails so recipients can verify the message hasn't been tampered with. | TXT (CNAME in some setups) |
DMARC | Tells receiving servers what to do if SPF or DKIM checks fail — and sends reports back to you. | TXT |
Step 1 — Check your current authentication status
Before making any changes, confirm which records are missing or misconfigured. Use a free online tool such as MXToolbox (mxtoolbox.com) or Mail Tester (mail-tester.com) to run a check on your domain.
Go to mxtoolbox.com/SuperTool.aspx.
Enter your domain name (e.g., yourcompany.com) and run an SPF lookup, DKIM lookup, and DMARC lookup separately.
Note which records are missing or show errors — those are the ones to fix.
Step 2 — Set up or fix your SPF record
An SPF record is a TXT record added to your domain's DNS settings. It lists the servers allowed to send email from your domain.
If you don't have an SPF record, add one. Log in to your domain registrar (GoDaddy, Namecheap, Google Domains, etc.) and add a new TXT record:
Field | Value |
Name / Host | @ (or your domain name, depending on your registrar) |
Type | TXT |
Value | v=spf1 include:_spf.google.com ~all |
TTL | 3600 (or default) |
Important: The include: value above is an example for Google Workspace users. If you use a different email provider (Microsoft 365, Outlook, Zoho, etc.), contact your email provider for the correct include: value to use — it will be different.
If you already have an SPF record, do not add a second one — DNS only allows one SPF record per domain. Instead, edit the existing record to add the new include: value before the final ~all or -all:
v=spf1 include:existing-provider.com include:new-provider.com ~all
Step 3 — Set up your DKIM record
DKIM requires generating a key pair through your email provider, then publishing the public key as a DNS record.
Log in to your email provider's admin console (e.g., Google Admin for Google Workspace, or the Microsoft 365 admin center).
Find the DKIM settings — usually under Settings > Email or Security > Email Authentication.
Click Generate or Enable DKIM. Your provider will show you the DNS record to add — it includes a selector (a unique identifier like google or s1) and a long public key value.
Log in to your domain registrar and add the record your provider gave you as a new TXT record.
Return to your email provider's admin console and click Authenticate or Start Authentication to activate DKIM.
DNS changes can take up to 48 hours to propagate. If your email provider says DKIM isn't verified yet, wait a few hours and check again before making further changes.
Step 4 — Add a DMARC record
A DMARC record tells receiving servers what to do when SPF or DKIM checks fail. Start with a monitoring-only policy so you can review the reports before enforcing strict rules.
Add a new TXT record at your domain registrar:
Field | Value |
Name / Host | _dmarc |
Type | TXT |
Value | v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com |
TTL | 3600 (or default) |
Replace dmarc-reports@yourdomain.com with an email address where you want to receive DMARC reports. Once you've reviewed reports and confirmed SPF and DKIM are working correctly, you can tighten the policy by changing p=none to p=quarantine or p=reject.
Step 5 — Verify everything is working
After adding or updating your DNS records, allow up to 48 hours for propagation, then verify:
Re-run the SPF, DKIM, and DMARC lookups on MXToolbox — all three should now show as passing.
Send a test email to a Mail Tester address (mail-tester.com) and review your score.
Ask a test recipient to check whether the email arrived in their inbox (not spam).
Common errors and fixes
Error | Likely cause | Fix |
"SPF PermError: too many DNS lookups" | Your SPF record triggers more than 10 DNS lookups. | Use an SPF flattening tool to consolidate includes into a single list of IP addresses. |
"Multiple SPF records found" | Two TXT records with v=spf1 exist on the same domain. | Delete the duplicate and merge everything into one SPF record. |
"DKIM record not found" | The DNS record hasn't propagated yet, or the selector is wrong. | Wait 48 hours and re-check. Confirm the selector in your email provider's DKIM settings matches the one you're looking up. |
"DMARC: No record found" | The _dmarc TXT record is missing or not yet propagated. | Add the record at your registrar and wait 24–48 hours. |
Emails still quarantined after fixing records | Recipient's server has an existing reputation block on your domain or IP. | Contact BoomTown Support — our team can escalate to the email deliverability team for further investigation. |
Still need help?
If you've completed the steps above and emails are still being blocked or quarantined, contact BoomTown Support. When reaching out, include:
Your sending domain (e.g., yourcompany.com)
A screenshot or copy of the bounce or quarantine message
The results of your MXToolbox SPF, DKIM, and DMARC lookups
The email provider you use (Google Workspace, Microsoft 365, etc.)
Having this information ready will allow the Support team to diagnose the issue quickly and escalate to our deliverability team if needed.