emailrules.today
Stop 3 of 8Week oneMilliseconds

DNS

The internet's phone book — where you publish SPF, DKIM keys, and DMARC for your domain.

Say it out loud

“The public record of who is allowed to send email as us. We control it, not our email platform.”

DNS (the Domain Name System) holds the public records for your domain, and all four email authentication records live there. This is the one part of the stack your platform genuinely cannot do for you: they can tell you the value, but only whoever holds the domain can publish it.

DNS recordThe four email records on one domainPublished valuesscrolls →
TYPE NAME VALUE
TXT @ v=spf1 include:_spf.google.com ~all

SPF sits at the root. The host field is @ or blank, never "spf".

TXT kl._domainkey v=DKIM1; k=rsa; p=MIIBIjANBgkq...

One per selector, per vendor. "kl" is Klaviyo's.

TXT _dmarc v=DMARC1; p=none; rua=mailto:...

The policy. Underscore, exactly one record.

TXT default._bimi v=BIMI1; l=https://...

Optional, and only worth publishing once DMARC is enforcing.

Every one of these is a TXT record and every one of them is publicly readable, on your domain and on your competitors'.

Yours

Nobody does this for you.

Where you find it

  • Cloudflare → your domain → DNS → Records
  • GoDaddy → Domain Portfolio → your domain → DNS
  • AWS → Route 53 → Hosted zones → your domain

What goes wrong

The host field. Your platform gives you a value and a name, and someone pastes `_dmarc.aurora.com` into a provider that automatically appends the domain, producing `_dmarc.aurora.com.aurora.com`. The record exists, at an address nothing will ever query, and every checker reports nothing at all.

What people get told

The claim. “DNS changes take 24 to 48 hours.”

Actually. That is registrar folklore from the 1990s. Propagation is governed by the TTL on the record, typically 300 to 3600 seconds. If it is not visible within an hour, it is wrong, not slow — and waiting a day is how a five-minute typo becomes a lost week.

Check it yourself

Read every email record on any domain, live

Run it now →

See also

Where this sits

Stop 3, it leaves your building. Your platform hands the message to a mail server, which stamps it with proof of who sent it.

← BeforeDKIMNext →SPF

FAQ

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.