Propagation

TXT Record Propagation — SPF, DKIM, DMARC

TXT record changes for SPF, DKIM, and DMARC typically propagate in minutes to 4 hours. Here's how to verify your email authentication records are live.

Different TXT, different sensitivity

SPF at apex, DKIM on _domainkey hosts, DMARC on _dmarc — each hostname caches independently.

SPF during propagation

Never publish two SPF TXT records. While caches mix, receivers can still PermError — merge first, then verify.

Verify end-to-end

Use Propagation for visibility across resolvers, then DNS Preflight for SPF/DKIM/DMARC checks against your live answers.

Check TXT propagation

Open Propagation checker →

Full auth check

Open DNS Preflight →

Deep dives: SPF setup · DKIM setup · DMARC setup

Step by step

Step 1 Avoid duplicate SPF — merge into a single v=spf1 TXT before expecting clean results.

Step 2 Give resolvers time; TXT TTL governs cache age.

Step 3 Use Propagation with type TXT on @ or _dmarc as needed.

Step 4 DNS Preflight validates SPF/DKIM/DMARC logic after DNS answers match.

Step 5 Send a test message and check headers once tools show green.

FAQ

How long do TXT records take to propagate?

Usually minutes to four hours for common public resolvers — same ballpark as other non-NS records.

Does email break while SPF TXT is propagating?

Receivers may see mixed old/new SPF during cache overlap. Minimise TTL before changes and avoid duplicate SPF records.

How do I know DKIM TXT is live everywhere?

Propagation for the DKIM host (selector._domainkey) plus DNS Preflight to confirm the key verifies.

How fast does DMARC at _dmarc update?

Same TXT rules — check the _dmarc hostname in Propagation, then read aggregate reports after policy changes.

Which tools should I use together?

Propagation for raw DNS agreement across resolvers; DNS Preflight for authentication semantics and alignment.

← All DNS record guides

Open DomainPreflight →