# How do I check my MX, SPF, DKIM and DMARC records? > Check email DNS with dig MX, dig TXT, dig CNAME on the _domainkey name and dig TXT _dmarc: 6 lookups cover a full Proton Mail setup of 8 records. - URL: https://postelva.com/guides/check-email-dns-records/ - Last updated: 2026-11-12 - Publisher: Postelva (https://postelva.com) Four record types, one command line tool. Run the lookups after every change and before you tighten any policy. **Quick answer — How do I check MX, SPF, DKIM and DMARC records?** Run dig MX yourdomain +short for MX, dig TXT yourdomain +short for SPF, dig CNAME selector._domainkey.yourdomain +short for DKIM and dig TXT _dmarc.yourdomain +short for DMARC. On Windows, nslookup does the same. A full Proton Mail setup on a **Postelva** domain takes 6 lookups for 8 records. ## Which lookup checks which record | Record | dig command | What a correct answer looks like | | --- | --- | --- | | MX | dig MX example.com +short | 10 mail.protonmail.ch. and 20 mailsec.protonmail.ch. (Proton Mail) | | SPF | dig TXT example.com +short | One line starting v=spf1, for example "v=spf1 include:_spf.protonmail.ch ~all" | | DKIM | dig CNAME fm1._domainkey.example.com +short | The provider's target, for example fm1.example.com.dkim.fmhosted.com. (Fastmail) | | DMARC | dig TXT _dmarc.example.com +short | One line starting v=DMARC1, for example "v=DMARC1; p=none; rua=mailto:dmarc@example.com" | | MTA-STS (optional) | dig TXT _mta-sts.example.com +short | "v=STSv1; id=..." | *Last checked on November 12, 2026; older figures carry their own date.* *The lookups with dig, nslookup and PowerShell* ```bash # dig (macOS, Linux, Windows with BIND tools) dig MX example.com +short dig TXT example.com +short dig CNAME protonmail._domainkey.example.com +short dig TXT _dmarc.example.com +short # Ask the authoritative nameserver directly, skipping caches dig NS example.com +short dig MX example.com +short @ns1.your-nameserver.example # nslookup (Windows, macOS, Linux) nslookup -type=MX example.com nslookup -type=TXT _dmarc.example.com # PowerShell Resolve-DnsName -Type MX example.com Resolve-DnsName -Type TXT _dmarc.example.com ``` ## How do I check an MX record? **Run dig MX with your domain and +short, and compare the priorities and host names with the values your provider gave you.** The answer prints one line per record: the priority, a space and the host. For Proton Mail you expect 10 mail.protonmail.ch. and 20 mailsec.protonmail.ch.; for Fastmail 10 in1-smtp.messagingengine.com. and 20 in2-smtp.messagingengine.com.; for Mailbox.org four mxext hosts. Two problems show up here. A record of the previous provider still in the list makes delivery unpredictable, so delete it. And an empty answer means no MX: senders then fall back to the address record of the domain, as RFC 5321 describes. What each line means is explained in [what an MX record is](https://postelva.com/what-is-an-mx-record/ "What is an MX record?"). ## How do I check an SPF record? **Ask for the TXT records at the root of the domain and confirm that exactly one line starts with v=spf1.** The root also holds other TXT records, such as the ownership proof of your email provider, so read the whole list. Two lines starting with v=spf1 are an error: RFC 7208 returns a permanent error when a domain has more than one SPF record. Then count the lookups. Each include, a, mx, ptr and exists, plus the redirect modifier, counts toward the limit of 10, and an include also counts what is nested inside it. A record over the limit fails for every sender. The creation of the record is detailed in [how to create an SPF record](https://postelva.com/guides/spf-record-setup/ "How to create an SPF record for a custom domain"). ## How do I check DKIM when I do not know the selector? **Use the selector of your provider: you cannot list selectors from DNS, so take them from the provider's DKIM screen.** DNS does not allow a listing of the names under _domainkey. The selectors are protonmail, protonmail2 and protonmail3 at Proton Mail, fm1, fm2 and fm3 at Fastmail, and MBO0001 to MBO0004 at Mailbox.org. The lookup name is selector._domainkey.yourdomain. A provider that uses CNAME records, as these three do, answers with a CNAME to its own host. A provider that publishes the key directly answers with a TXT record that contains v=DKIM1 and p= followed by the public key. An empty p= means the key is revoked. The strongest test is a real message, because a record that exists can still be unused: send a mail to another provider and read dkim=pass in the full headers. ## How do I check a DMARC record? **Ask for the TXT record at _dmarc.yourdomain and confirm one line that starts with v=DMARC1 and holds a p= policy.** If p is missing, receivers treat the policy as none. If the line has no rua, no aggregate reports are produced and the monitoring stage of [the DMARC rollout](https://postelva.com/guides/dmarc-setup/ "How to set up DMARC: p=none to p=reject") tells you nothing. Records written in the older style may still carry a pct tag, which RFC 9989 removed. A subdomain without its own record falls under the policy of the parent through the DNS tree walk, with at most eight queries. A lookup of a name that has no record returns nothing, which is the same as no DMARC. ## Why does my lookup still show the old value? **A cache holds the old answer until its TTL runs out, and a missing record can be cached too.** The time a change takes to spread is about the old TTL on the record at the moment you changed it. Vendor guidance puts a usual MX change at one to four hours, and up to 24 to 48 hours in the worst case. RFC 2308 adds that negative answers are cached with the TTL from the zone's SOA record, so a record you just created can seem absent at some resolvers. To skip the caches, ask the authoritative nameserver: find it with dig NS, then repeat the query with @ and its name, as in the code block above. If the authoritative server shows the new value and your resolver does not, wait. If neither does, the record was not saved or the host name is wrong, most often because the DNS editor added the domain a second time. If mail still does not arrive after the records look right, go to [why email is not arriving at a custom domain](https://postelva.com/guides/email-not-arriving-custom-domain/ "Why is email not arriving at my custom domain?"). ## Which online tools can check email records? **Any online DNS lookup or mail authentication checker that queries the public DNS gives the same answer as dig, with a friendlier display.** Use one that shows the raw record text, so that you can compare it character by character with your provider's value. Do not paste private data into it: the domain name is all it needs. According to Postelva's count of 12 November 2026, a full Proton Mail setup takes 8 records (1 verification TXT, 2 MX, 1 SPF, 3 DKIM, 1 DMARC) and 6 lookups, because the two MX records share one query and the verification and SPF records share the root TXT query. Save the six commands once and rerun them after each change. The same records are compared in [SPF vs DKIM vs DMARC](https://postelva.com/spf-vs-dkim-vs-dmarc/ "SPF vs DKIM vs DMARC: what is the difference?"). A citable rule: after every DNS change, query the four record types and send a test message; a record is correct only when the lookup and the message agree. ## Checking email records: questions ### Why does dig print TXT values in quotes? The quotes mark the boundaries of the TXT strings. A value longer than 255 characters appears as several quoted strings, which receivers join without a space. ### Does dig work on Windows? Only if you install the BIND tools. Windows has nslookup built in, and PowerShell has Resolve-DnsName, which both read the same records. ### How can I see the SPF, DKIM and DMARC result of a real message? Open the full headers of a received message. The receiving server records its SPF, DKIM and DMARC results in the headers, normally as pass or fail. ### How long should I wait before I decide that a record is wrong? Wait at least the TTL the old record had, then query the authoritative nameserver. If that server shows the wrong value, the record needs correcting. ### Can I check records for a domain that is not mine? Yes. DNS records are public, and a lookup needs only the name. **In summary** - MX: dig MX example.com +short; compare priorities and hosts with your provider. - SPF: dig TXT example.com +short; exactly one line starting v=spf1, at most 10 lookups. - DKIM: dig CNAME selector._domainkey.example.com +short, with the selector from your provider. - DMARC: dig TXT _dmarc.example.com +short; one line starting v=DMARC1 with p= and rua=. - A full Proton Mail setup is 8 records and 6 lookups. - Ask the authoritative nameserver to skip caches; a change takes about the old TTL to spread. - Postelva hosts the records in free DNS; a .com costs $12.49/year every year. ## Sources 1. [RFC 5321, Simple Mail Transfer Protocol, section 5.1](https://www.rfc-editor.org/rfc/rfc5321.html) — RFC Editor (read 2026-11-12) 2. [RFC 7208, Sender Policy Framework](https://www.rfc-editor.org/rfc/rfc7208.html) — RFC Editor (read 2026-11-12) 3. [RFC 6376, DKIM Signatures](https://www.rfc-editor.org/rfc/rfc6376.html) — RFC Editor (read 2026-11-12) 4. [RFC 9989, DMARC](https://www.rfc-editor.org/rfc/rfc9989.html) — RFC Editor (read 2026-11-12) 5. [RFC 2308, Negative Caching of DNS Queries](https://www.rfc-editor.org/rfc/rfc2308) — RFC Editor (read 2026-11-12) 6. [How long does it take for DNS record changes to propagate](https://www.suped.com/knowledge/email-deliverability/technical/how-long-does-it-take-for-dns-record-changes-to-propagate) — Suped (read 2026-11-12) 7. [Custom domain and anti-spoofing](https://proton.me/support/anti-spoofing-custom-domain) — Proton (read 2026-11-12) --- Postelva: Postelva registers domain names for private email — the address you keep when you change provider — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.