DNS Setup Checklist for Deliverability

Use this checklist when a report shows DNS, routing, or infrastructure warnings.

Core sender identity

  • SPF TXT exists and authorizes every real sending provider.
  • DKIM selector records are published and the provider is actively signing.
  • DMARC exists at _dmarc and uses a valid reporting mailbox.

Mail routing

  • MX records resolve and point at the intended mail host.
  • Reverse DNS (PTR) exists for outbound IPs when you control them.
  • HELO or EHLO hostname resolves forward and reverse cleanly.

Transport security

  • mta-sts policy is published if you enforce TLS delivery policy.
  • smtp._tls TLS-RPT record is valid if you want transport reports.
  • DANE only if you operate DNSSEC correctly and know the maintenance cost.

Reputation support

  • Outbound IPs are not on DNSBLs.
  • Domain links resolve consistently and do not bounce through broken redirects.
  • Public web hostnames used in email assets have valid certificates.

Operational habits

  • Keep TTLs low while changing provider records.
  • Remove retired vendor includes after migrations.
  • Re-test after propagation instead of reading stale cached lookups.

When this checklist matters most

  • New domain onboarding
  • ESP migration
  • Dedicated IP cutover
  • TLS policy rollout
  • Sudden inbox placement drop after DNS edits

If you complete this checklist and warnings remain, inspect the exact failing check in the report rather than changing unrelated DNS records.