MX: inbound mail routing
Mail exchanger records advertise the servers that accept messages for a domain. Lower preference numbers are normally tried first. Multiple entries can provide redundancy, but only when the provider configured them as a set. An MX record is not proof that a mailbox exists or that delivery will succeed.
SPF: permitted sending infrastructure
SPF is a TXT policy describing infrastructure authorized to send using the domain. Mechanisms can reference IP addresses, hostnames and provider-maintained include policies. DNS lookup limits matter because receivers need to evaluate the policy; nested includes and redirects can make a policy too expensive to process.
Avoid publishing a second SPF policy to add a service. Legitimate senders generally need to be represented within one coherent policy. Use the exact values supplied by each provider and remove mechanisms only after confirming they are unused.
DMARC: alignment, policy and reporting
DMARC checks whether an authenticated SPF or DKIM identity aligns with the domain visible to the recipient. Its policy can request monitoring, quarantine or rejection. Aggregate reports help domain owners see who sends on their behalf and whether authentication aligns.
Why DNS changes take time
Recursive resolvers cache answers based on time-to-live values. A record updated at the authoritative provider can coexist temporarily with an older cached answer elsewhere. Check that the record was saved in the correct DNS zone, note its TTL and avoid repeatedly adding competing records while waiting.
What a browser-based check can and cannot tell you
Ready DNS queries public DNS data and applies transparent diagnostic rules. It can identify missing records, policy text and certain visible risks. It cannot log into your provider, validate every third-party sender, confirm that every message receives a DKIM signature, inspect private DNS, guarantee inbox placement or certify security.
Before changing production DNS
- Export or record the current working values.
- Use the mail provider’s current documentation.
- Identify all transactional, marketing and employee-mail senders.
- Make one understandable change at a time.
- Retest after relevant caches can expire and monitor real mail.
Protocol references
The technical foundations are defined in RFC 7208 for SPF and RFC 7489 for DMARC. Provider instructions remain essential because they specify the records for your actual mail systems.
Published and last updated 6 September 2026. This educational overview is not a substitute for your email provider’s configuration instructions or a professional security review.