DNS
The internet's phone book — where you publish SPF, DKIM keys, and DMARC for your domain.
Say it out loud
“The public record of who is allowed to send email as us. We control it, not our email platform.”
DNS (the Domain Name System) holds the public records for your domain, and all four email authentication records live there. This is the one part of the stack your platform genuinely cannot do for you: they can tell you the value, but only whoever holds the domain can publish it.
SPF sits at the root. The host field is @ or blank, never "spf".
One per selector, per vendor. "kl" is Klaviyo's.
The policy. Underscore, exactly one record.
Optional, and only worth publishing once DMARC is enforcing.
Every one of these is a TXT record and every one of them is publicly readable, on your domain and on your competitors'.
Yours
Nobody does this for you.
Where you find it
- Cloudflare → your domain → DNS → Records
- GoDaddy → Domain Portfolio → your domain → DNS
- AWS → Route 53 → Hosted zones → your domain
What goes wrong
The host field. Your platform gives you a value and a name, and someone pastes `_dmarc.aurora.com` into a provider that automatically appends the domain, producing `_dmarc.aurora.com.aurora.com`. The record exists, at an address nothing will ever query, and every checker reports nothing at all.
What people get told
The claim. “DNS changes take 24 to 48 hours.”
Actually. That is registrar folklore from the 1990s. Propagation is governed by the TTL on the record, typically 300 to 3600 seconds. If it is not visible within an hour, it is wrong, not slow — and waiting a day is how a five-minute typo becomes a lost week.
Check it yourself
Read every email record on any domain, live
Run it now →See also
Where this sits
Stop 3, it leaves your building. Your platform hands the message to a mail server, which stamps it with proof of who sent it.