# SPF, DKIM, or DMARC is failing

> Broadcast monitors SPF, DKIM, and DMARC per sending domain and flags drift. Here is what each status means and what to do about Missing, Changed, and Unverifiable.

Source: https://sendbroadcast.net/how-to/fix-dns-authentication

Broadcast checks the DNS records for each sending domain automatically every six
hours, and on demand with **Check all now**. Start at the **Domain DNS Health** page
rather than at your DNS provider, because it tells you what Broadcast actually sees.

## What each status means

| Status | Meaning |
| --- | --- |
| **Healthy** | Present and matching the known-good baseline. |
| **Missing** | No record found. If it was previously healthy, this is drift and can raise an alert. |
| **Changed** | The record differs from the known-good baseline. |
| **Unverifiable** | The DNS lookup failed or timed out. Never triggers an alert. |
| **Not checked** | No check has run yet, or for DKIM, no selectors are being monitored yet. |

[The full documentation](https://sendbroadcast.net/docs/dns-health) covers each of these
in detail.

![A domain card showing SPF Healthy, DKIM Not checked with a selector field, and DMARC Missing with a suggested record](https://sendbroadcast.net/assets/docs/dns-health/dns-health-card-39cda88c.png)

Each record shows what Broadcast actually resolved, next to what your provider expects it to be.

## Missing or Changed

Something was edited at your DNS provider. Common causes: a registrar migration, a
CDN or mail provider rewriting records, or someone replacing an SPF record instead of
merging into it.

1. Compare the observed record shown on the domain card against what your provider
   expects.
2. Fix it at your DNS host.
3. Re-run the check. DNS propagation means this is not always instant.
4. If the new value is correct and intentional, **reset the baseline** so Broadcast
   stops flagging it as drift.

A note on SPF: you get one SPF record per domain. If you send through more than one
service, they merge into a single record. Two separate SPF records is a failure, not
a redundancy. The [SPF record generator](/tools/free-spf-record-generator) helps
build a correct one.

![A drift alert warning that email authentication DNS records have changed and mail may fail authentication](https://sendbroadcast.net/assets/docs/dns-health/dns-health-drift-banner-2c590de9.png)

Drift alerts fire when a record that was previously healthy changes, usually a registrar or CDN edit nobody mentioned.

## Unverifiable

The lookup itself failed. This is usually your DNS provider being slow or briefly
unreachable, not a record problem. Re-check before changing anything.

## DKIM shows Not checked

Broadcast has no selectors to monitor for that domain yet. The documentation covers
adding **manual DKIM selectors** when your provider's selectors are not discovered
automatically.

DKIM being present is not the same as DKIM being aligned. If DKIM passes but DMARC
still fails, read [DKIM signature alignment](/dkim-signature-alignment).

## DMARC

If DMARC is missing, the documentation has a setup section. Start at `p=none` and
watch the reports before moving to quarantine or reject. Going straight to `p=reject`
on a domain you have not observed is how legitimate mail gets thrown away. The
[DMARC record generator](/tools/free-dmarc-record-generator) and
[DMARC checker](/tools/free-dmarc-testing-tool) help.

## After it is green

Authentication being correct does not retroactively fix reputation damage. If mail
was landing in spam while records were broken, see
[emails going to spam](/how-to/emails-going-to-spam).

---

[Send us what the page shows](mailto:simon@sendbroadcast.net?subject=DNS%20health%20question)
if the fix is not obvious.