Verifying SPF, DKIM, and DMARC in Staging
Every message that arrives over MX is checked against the sender's SPF record, DKIM signature, and DMARC policy. Send from staging to a sandbox address and you get a verdict on your DNS before any real recipient does.
Setup
Add a sandbox domain and point its MX record at mx.smtp.dev
Domain setup has the record.
Create a recipient account
e.g. authcheck@sandbox.example.com on the Accounts page.
Send to it from your staging infrastructure
Through the same provider and DNS your production traffic will use. Authentication checks the path the message took, so it has to actually leave your infrastructure.
Reading the Results
Open the message in Mail - verification results are shown with the message. Over the API, they're on the Message resource:
curl "https://api.smtp.dev/accounts/{accountId}/mailboxes/{mailboxId}/messages/{id}" \
-H "X-API-KEY: smtplabs_your_api_key_here" | jq '.verifications'
For the underlying headers, fetch the raw source.
What Each Check Means
| Check | Passes when |
|---|---|
| SPF | The delivering server's IP is listed in the envelope sender domain's SPF record |
| DKIM | The message signature validates against the public key published in the signer's DNS |
| DMARC | SPF or DKIM passes and the passing domain aligns with the visible From domain |
Common Failures
- SPF fails after adding a provider: the provider's
include:is missing from your SPF record, or the record now exceeds the 10-DNS-lookup limit. - DKIM fails on a fresh setup: the selector in the signature doesn't match the DNS record name, or the key was rotated and DNS still serves the old one.
- SPF and DKIM pass, DMARC fails: alignment. The domain that passed isn't the one in
From- typical when a provider signs with its own domain instead of yours.
send.smtp.dev never crosses your DNS, so it says nothing about your SPF or DKIM. Send from the infrastructure you're validating.Catch-All
A * account catches mail for every address on your domain that has no account of its own. A fresh address per test, no setup per address.
E2E Flows
A Playwright test that triggers a reset, polls the API for the email, extracts the link, and finishes the flow. Same pattern for signup confirmations.