In-App DNS Health Auditor (SPF, DKIM, DMARC, BIMI)

Located under MailFuz → Settings → System Status → DNS Authentication Auditor, this tool probes your live nameservers in real-time.

Checked Records

1. SPF (Sender Policy Framework)

What it does: Specifies which mail servers are permitted to send emails on behalf of your domain.
Format: A DNS TXT record at root (@).

Example:

v=spf1 include:amazonses.com include:resend.com a mx ~all

Status Flags: MailFuz checks if v=spf1 is present and recommends provider-specific include tags.

2. DKIM (DomainKeys Identified Mail)

What it does: Signs outgoing messages with a private cryptographic key, verified against your public key published in DNS.
Common Selectors: Probes mail._domainkey, default._domainkey, k1._domainkey, resend._domainkey, google._domainkey, and smtp._domainkey.

Example:

mail._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8..."

3. DMARC (Domain-based Message Authentication, Reporting & Conformance)

What it does: Tells receiving mailbox providers how to handle emails that fail SPF or DKIM checks.
Location: DNS TXT record at _dmarc.yourdomain.com.

Recommended Policy:

_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Enforcement: MailFuz warns if your policy is set to p=none (monitoring only) and recommends transitioning to p=quarantine or p=reject.

4. MX & BIMI Records

MX Records: Verifies mail exchange records to ensure recipient return-paths and bounce handling function properly.
BIMI (Brand Indicators for Message Identification): Checks for published SVG logos displayed next to your emails in supporting inboxes.