The three records that decide whether your email lands
Gmail and Outlook each handle 60-70% of UK B2B inboxes between them. Both run an authentication stack that blends SPF, DKIM, and DMARC into a deliverability score. A domain with all three configured and aligned lands in the primary inbox. A domain missing any one of them gets quietly demoted into Promotions or Spam, and the sender usually doesn't notice because their own mailbox provider doesn't apply the same rules to their own outbound.
SPF: who can send on your behalf
SPF is a TXT record that lists every server allowed to send email claiming to be from your domain. The record starts with v=spf1 and ends with a softfail (~all) or hardfail (-all) directive. Most UK SMBs have an SPF record from when they set up Google Workspace and forgot to update it when they added Mailchimp, Stripe, SendGrid, or any other email sender. Each additional sender needs to be listed in the SPF record (via include: directives) or its mail will fail authentication.
DKIM: cryptographic signature
DKIM signs outbound email with a private key; receivers fetch your public key from DNS and verify the signature. Each email provider publishes their DKIM public key under a selector-specific subdomain. Google uses google._domainkey.yourdomain.com. Microsoft uses selector1._domainkey and selector2. The checker tries the common selectors automatically; for custom senders you'll need to confirm the selector with your provider.
DMARC: what to do when SPF or DKIM fail
DMARC is the policy on top. It tells receivers whether to do nothing (p=none, monitor only), put failures in spam (p=quarantine), or reject them outright (p=reject). Most UK SMBs are stuck at p=none forever because nobody ever revisits the policy after the initial setup. p=nonegives you DMARC reports but doesn't improve deliverability. p=quarantine is the right long-term state for most SMBs; p=rejectis best-practice once you're confident every legitimate sender passes.
How to use this checker
Enter your domain. The checker queries Cloudflare's public DNS-over-HTTPS resolver and surfaces the SPF, DKIM, and DMARC records. Each result shows pass/warn/fail with a specific fix if needed. The lookups are public DNS; nothing personal leaves the request. For DKIM custom selectors, set the selector field manually (your email provider's DNS setup guide will tell you what to use).
Where NuvenarHub Mail fits
NuvenarHub Mail gives you the authenticated infrastructure for broadcasts and transactional email, with a guided DNS setup that publishes the right SPF include, DKIM key, and DMARC starter policy. You still control the records (they need to cover Google Workspace, Stripe, and your other senders too), but the path from "new domain" to "everything passes" takes minutes instead of weeks.