PayFlowFix.dev
guide · spf dkim dmarc explained

SPF, DKIM and DMARC, in the order they actually run

SPF checks the sending server, DKIM checks the signature, DMARC checks that either one aligns with the domain your recipient sees. Understanding the order is what makes the failures make sense.

What this actually means

This is the common pattern we see when spf dkim dmarc explained comes up in search.

Run the free checker on your domain to see your own numbers. The checker shows the full SPF include chain, the exact lookup count, and which selector actually exists for DKIM.

Why it matters for payment flows

Customers who pay successfully but never get a receipt, invoice or status update assume the payment failed. Support tickets follow, refunds are requested, and the engineering team spends hours debugging a webhook that never had a chance to be read.

What to do next

  1. Check the domain with the free tool.
  2. Fix the mechanical issue first — lookup limit, missing DKIM, absent DMARC. Those are checkable in under a minute.
  3. If email authentication is clean and the customer still sees nothing, the fault is downstream: a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced.

Sources and standards

  • RFC 7208 SPF, RFC 7489 DMARC, RFC 6376 DKIM — the actual specifications, not a blog summary.
  • Lookup counts measured live with the engine in this repo, https://payflowfix.dev.

FAQ

SPF, DKIM and DMARC explained, in the order they run
SPF checks the sending server, DKIM checks the signature, DMARC checks that either one aligns with the domain your recipient sees. Understanding the order is what makes the failures make sense.
Where does this fit in a payment flow?
Email authentication is upstream of whether a customer ever sees a receipt. If SPF, DKIM or DMARC is broken, the receipt, invoice or password reset lands in spam or is rejected. That looks like a payment integration failure, but it is DNS.
Can I check this myself?
Yes — the free checker expands your whole SPF chain and counts lookups the way a receiver does. Paste your domain and you get a copy-ready record.
Do you log my domain?
No. The checker runs in your browser against Cloudflare and Google DNS-over-HTTPS. This site is static; there is no backend.

Still broken after the DNS is right?

Email authentication is DNS. Payment notifications not arriving is usually not — it is a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced. That is what I fix: a fixed-fee $99 root-cause diagnosis, credited toward the repair.

Get a $99 diagnosis What I fix