Is your domain set up for email?

Four records do almost all of the work. MX says which servers accept mail for the domain. SPF is a TXT record at the domain itself listing the servers allowed to send as you. DKIM is a public key under a selector name such as google._domainkey; your provider signs each message with the private half so receivers can prove it was not altered. DMARC lives at _dmarc.yourdomain and tells receivers what to do when a message fails the other two, and where to send reports. Reverse DNS on the mail hosts is set by whoever owns the server's IP, so with a hosted provider it is already done, and MTA-STS is an optional extra that lets senders insist on encryption.

Existing is not the same as aligned. DMARC passes only when the domain in the From header matches the domain that passed SPF or signed with DKIM, so a newsletter tool sending from your address but signing with its own domain exists in DNS and still fails. Receivers also weigh reputation: a brand new domain, a sudden jump in volume, or recipients who never open your mail will push messages to spam with perfect DNS. When every check above passes and mail still misses the inbox, paste the message's headers into the header analyzer and read the Authentication-Results line the receiver wrote.

Each red or amber row shows the record to publish, in the Host, Type and Value shape your registrar's DNS panel uses. Copy the value, add a record of that type at that host, and check again after a few minutes. Keep exactly one SPF record and merge rather than add. For DMARC, start with p=none, read a couple of weeks of reports with the report analyzer, then move to quarantine. If your domain is at Cloudflare, Namecheap, GoDaddy, Porkbun or another registrar, there is a step by step guide with the exact tabs and field names.