Mail authentication audit (SPF, DMARC, DKIM)

Contact forms, registration mail and shop notifications are sent from your domain. Without SPF and DMARC anyone can forge mail from it, and your genuine mail is more likely to land in spam. The Mail Authentication card under Settings → Analysis checks the three DNS records.

What it shows

• SPF - hard fail (-all) passes; soft fail (~all) is a transition setting; missing, duplicated or permissive records are warnings.
• DMARC - p=reject passes, p=quarantine is fine, p=none only monitors and is a warning.
• DKIM - looks for a record at common selectors. Selector names are chosen by your mail provider, so "none found" is shown as verify, never as a failure; confirm in your provider's dashboard.

The domain checked is the one in your Global Configuration Sender Email, falling back to the site's domain. The audit only performs DNS lookups - no mail is sent - and results are cached for an hour. Use Re-check DNS after changing records. If DNS lookups fail from your server, it says Could not check rather than guessing.