Verify sending domains with DKIM, SPF and staged DMARC
Add a domain and Minket lists the records to publish, checks them, and shows what fails and why.
Domains
mail.fernbank.example
- Status
- Partly verified
- Authentication
- Failing
- Last check
- 52 minutes ago
Live mail waits until the SPF record on the bounce host checks out.
- DKIM
CNAME7f3a9c._domainkey.mail.fernbank.example7f3a9c.dkim.amazonses.comVerified - DKIM
CNAMEb21e04._domainkey.mail.fernbank.exampleb21e04.dkim.amazonses.comVerified - DKIM
CNAMEc9d811._domainkey.mail.fernbank.examplec9d811.dkim.amazonses.comVerified - MAIL FROM
MXbounce.mail.fernbank.example10 feedback-smtp.<region>.amazonses.comVerified - SPF
TXTbounce.mail.fernbank.examplev=spf1 include:amazonses.com ~allThe TXT on the bounce host does not include amazonses.com.Failed - DMARC
TXT_dmarc.mail.fernbank.examplev=DMARC1; p=none; rua=mailto:dmarc@fernbank.exampleVerified
Checked every hour until they verify
Then every 6 hours, and test keys keep working while a record fails.
403 domain_authentication_failed SPF, DKIM or DMARC is failing for this domain. Sending resumes when DNS is fixed.
DMARC is staged by a person
It tightens one step at a time, and only while the domain passes.
p=noneReceivers report; nothing is filtered.p=quarantineMail that fails goes to spam.p=rejectMail that fails is refused.
Cloudflare writes the records it showed you
With a Cloudflare token the console lists what it would write, writes it, and never changes a record it did not create.
| Record | Type | Plan |
|---|---|---|
| DKIM | 3 CNAME | create |
| MAIL FROM | MX | create |
| SPF | TXT | create |
| DMARC | TXT | already in place |
Reports, Postmaster, seed tests and BIMI
Aggregate reports
Reports sent to
dmarc@become the domain's 30-day pass rate.Postmaster
Gmail's view of the domain, once it sends a few hundred messages a day to Gmail.
Seed tests
Inbox placement checked every 7 days across up to 10 seed inboxes.
BIMI
Your logo in the inboxes that show one, from
p=quarantineup.
Questions
Do subdomains work?
Yes: mail.fernbank.example gets its own records and checks, apart from fernbank.example.
Do I need Cloudflare?
No. Publish the records at any DNS host; the token only saves the copying.
How many domains per project?
Up to 50.