What the three records do
- MX names the servers that receive mail for the domain.
- SPF lists the servers allowed to send mail as the domain. It must be a single record, and it may trigger at most 10 DNS lookups.
- DMARC tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. Start with a policy of none to watch, then move to quarantine or reject.
Good setups also sign mail with DKIM, which we cannot check without knowing your provider's selector. Your mail provider's setup page shows the exact records to add. The lookup runs in your browser against Cloudflare's public resolver.