These three DNS records tell receiving servers your email is legitimate. Formitor checks them and, when a test email gets through, reads the real authentication results from the message headers.
- SPF lists which servers may send mail for your domain. A softfail means the sending service isn't included; add it to your SPF record.
- DKIM is a cryptographic signature proving the message wasn't tampered with. We can't always see your DKIM selector from DNS alone, so it may show as "can't confirm", which is not the same as broken.
- DMARC ties SPF and DKIM together and tells receivers what to do with mail that fails.
Subdomains and DMARC
DMARC is inherited. When mail goes out from a subdomain such as www or mail, receivers look for a record on the subdomain first and then fall back to your main domain. Formitor follows the same order, so one record at the top level covers the whole site.
Dismissing the missing-record warning
A site with no DMARC record shows a DMARC missing badge. If you have decided not to publish a record for now, open the site's Deliverability strip and choose Dismiss DMARC warning. The badge changes to a grey DMARC dismissed and stops counting against the site's deliverability status. Checks keep running daily, and the badge returns to the real status by itself once a record appears. Restore DMARC warning brings the warning back at any time.
Safe order for DMARC
Always start at p=none (monitor only) and watch the reports for a few weeks before moving to stricter policies. Jumping straight to p=reject can block your own legitimate mail.
Which domain we check
Mail usually leaves your site through a sending domain rather than your web address. A common setup is mg.yoursite.com, created by an SMTP plugin or a mail provider, and that is where your SPF, DKIM and DMARC records belong.
Formitor works out the domain your mail really comes from, in this order:
- A real delivered message. When a test email reaches our seed mailbox we read the receiving server's own verdict out of the headers. This is the most reliable answer there is.
- Your site's own report. From plugin 0.2.50 the site tells us the domain it really sends mail from, but only when something can vouch for the address: it belongs to your own domain, or your SMTP plugin's settings name it. An address a visitor typed into your form is never treated as yours. It reports the domain only and never sends us an address. Records kept before 0.2.50 are ignored, so a site may report nothing for a short while after updating and grade on its website domain until it sends again.
- Your web address. Used only when neither of the above is available, and it is a guess.
Hover the Deliverability label on a site to see which domain was checked and which of these three it came from. If the domain looks wrong, check which sending address your SMTP plugin is configured with.