SPF, DKIM, and DMARC: what to check when mail starts missing the inbox

Abstract blue light streams through a dark network mesh, representing email deliverability paths.

When delivery drops after a tool or DNS change, start with authentication alignment—not a vague warmup checklist.

Start with the cause, not the symptom

Spam-folder spikes and failed warmups often share the same root: SPF, DKIM, or DMARC no longer match how mail is actually sent.

What to inspect first

SPF — does the record authorize the servers and tools that send today?
DKIM — are messages signed with a key that still exists and aligns with the From domain?
DMARC — is policy set, and do SPF/DKIM results align with the organizational domain?

Then check subdomain and tool overlap. New ESPs, forwarding, and “helpful” DNS edits are common break points.

Validate after changes

Fix in a safe order, then confirm with the same signals mailbox providers use. The free Inbox Placement Test is a practical first pass; request a deliverability audit when you need a fix list and ownership notes.