Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →You can test sender authentication from a script and make a required failure stop a CI build. The reliable approach is two-layered: check the DNS configuration for the identities your mail actually uses, then—if you need to validate the sending path—send a uniquely identifiable message to a mailbox you control and inspect its authentication results. A passing check confirms only the conditions you tested; it cannot guarantee inbox placement.
What a script can—and cannot—prove
Email “deliverability” can mean several things. A DNS check can tell you whether expected authentication records are published. A received-message test can tell you how a particular receiver evaluated a particular message. Neither proves that messages will reach every recipient’s inbox: reputation, message content, recipient settings, and other provider signals also matter. Google says authenticated messages are less likely to be rejected or marked as spam by Gmail, not that authentication guarantees delivery. Google’s sender guidelines
Keep the result narrowly worded. A successful SMTP submission means the sending service accepted the message; it is not evidence that the recipient received it. A passing SPF or DKIM result is not, on its own, proof of DMARC alignment or inbox placement.
Identify the domains and records to check
Do not check an arbitrary domain just because it is the website domain. Follow the identities used by the actual message:
#1 Best Overall
- SPF: Check the domain in the message’s envelope sender, often called the MAIL FROM or return-path domain. SPF lets receivers determine whether the sending infrastructure is authorized by that domain’s policy. RFC 7208
- DKIM: Check the signing domain (
d=) and selector (s=) used in the message’s DKIM signature. The receiver uses the selector and domain to find the published public key and verify the signature. RFC 6376 - DMARC: Check the domain in the visible From header. DMARC publishes a receiver policy and requires at least one passing SPF or DKIM result to align with that From domain. A bare SPF pass does not necessarily pass DMARC. RFC 7489
Use the sending provider’s setup instructions to determine the expected DNS values. Finding a TXT record is not enough: it must be the right record for the provider and identity being used. Google’s sender guidelines also describe SPF, DKIM, and DMARC requirements for senders to Gmail. Its cited 5,000-messages-per-day bulk-sender threshold is a Google policy scope, not a universal email rule. Google’s sender guidelines
Choose the check that matches your goal
| Approach | What it checks | Does it exercise the real sending path? | Main trade-off |
|---|---|---|---|
| DNS-only script | Published SPF, DKIM, and DMARC configuration | No | Fast and straightforward to make deterministic, but does not show how a receiver evaluated a message. |
| Send and inspect through your provider | Message delivery to a controlled mailbox and the receiver’s authentication verdicts | Yes, if sent through the same provider and configuration you want to validate | Requires sending credentials and a mailbox you control; results describe that message and receiver. |
| Email sandbox | Application send flow and message content, with automated retrieval in supported setups | Usually a sandboxed path, not necessarily the real external-recipient path | Convenient for development, but sandbox-only delivery does not establish real-recipient inbox placement. |
| Self-hosted analysis platform | Potentially a wider range of message and mail-flow details | Depends on configuration | More operational work; happyDeliver, for example, documents an analysis platform whose receiving setup requires inbound port 25 to be reachable. happyDeliver project |
SMTP.dev documents an automated sandbox workflow, but says its sandbox messages are delivered only to sandbox accounts. Use that kind of test to validate the application’s sandboxed message flow—not as evidence that external recipients will see the message in their inboxes. SMTP.dev
Rank #2
Build the checks in two layers
Layer 1: validate expected DNS configuration
- Get the actual envelope sender domain from the sending configuration or a representative message. Resolve that domain’s SPF policy and confirm it authorizes the sender using the provider’s documented setup—not merely that an SPF-like TXT record exists.
- Get the DKIM signing domain and selector from a representative signed message or the provider configuration. Look up the public key at the corresponding selector-and-domain DNS name, and check that DKIM signing is enabled in the sending service.
- Read the DMARC policy for the visible From domain. Confirm the record and its alignment expectations match the organization’s policy and provider setup.
- Make each required assertion explicit in code, and report the identity and check that failed. Do not print credentials or private DKIM keys.
The protocol standards define how SPF, DKIM, and DMARC work; the provider’s instructions determine the expected record values. Keep the checker tied to the domains and selector your messages actually use.
Layer 2: send and inspect a controlled message
- Send a test message through the sending path you want to validate to a mailbox the team controls.
- Give each run a unique subject or message identifier so parallel or scheduled jobs cannot mistake old mail for the current result.
- Retrieve the received message’s raw headers and inspect
Authentication-Results. Assert on the receiver’s SPF, DKIM, and DMARC results; for DMARC, check alignment as well as a pass verdict. - Associate the retrieved message with the current run before evaluating it. A successful send request alone is not a passing received-message test.
Microsoft’s troubleshooting guidance recommends using the received authentication results to diagnose failures: SPF-only failures point to the SPF record, DKIM-only failures to enabling DKIM and publishing its records, and DMARC failures caused by alignment to correcting alignment. Microsoft Learn: email authentication
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Make failures meaningful in CI
Run the checker as a normal command in your CI workflow. Have it exit nonzero when a required assertion fails; the CI system can then report the failure with the build or pull request. GitHub Actions supports event-triggered and scheduled workflows, and its documentation explains how test failures appear in pull requests. GitHub Actions is one option, not a requirement. GitHub Actions documentation
Run on changes to email templates, sending configuration, deployment configuration, and the checker itself. Add a scheduled run if you also want to catch DNS changes or drift when application code has not changed.
Rank #4
- Fail the build: a required record or configuration is missing or invalid, or the controlled received message fails the team’s explicitly stated aligned-authentication condition.
- Report an infrastructure error separately: a temporary DNS lookup failure, unavailable mailbox, or receiver outage may prevent a reliable verdict. Use a bounded retry and a clear infrastructure-error status rather than presenting an unverified result as a confirmed permanent authentication failure.
- Keep secrets scoped: store sending and mailbox credentials in the CI platform’s secret store, grant them only to workflows that need them, and do not send test messages to customers. SMTP.dev’s example uses GitHub Actions secrets for an API key and sender password; adapt the pattern to your provider and security controls. SMTP.dev
These failure categories and retry behavior are implementation choices: document them so a red build tells developers whether authentication actually broke or the test could not complete.
Quick Recap
Interpret the result without overclaiming
- SPF fails: Verify which envelope sender domain the receiver evaluated and whether the actual sending source is authorized by its SPF policy. Microsoft’s troubleshooting matrix points to correcting the SPF record, such as adding the sending IP or provider include, when SPF alone fails. Microsoft Learn: email authentication
- DKIM fails or is absent: Check that signing is enabled and that the public key is published for the signing domain and selector in the message. Microsoft identifies enabling DKIM and adding DNS records as the remedy for DKIM-only failures. Microsoft Learn: email authentication
- SPF and DKIM pass, but DMARC fails: Check whether the authenticated SPF or DKIM domain aligns with the visible From domain. Authentication without alignment may not satisfy DMARC. Microsoft Learn: email authentication
- All three pass: The tested receiver reported successful authentication for that message. Do not label the result “guaranteed inbox delivery.”
- A sandbox can retrieve the message: The sandbox test confirms the application produced a message the sandbox could retrieve. If the sandbox routes only to its own accounts, the result does not establish how a real external provider will handle it. SMTP.dev
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
