Fixing "spf=none" and "dkim=none": missing email authentication

none is different from fail: it means there is nothing to check. spf=none means no SPF record exists, dkim=none means the message was not signed, and dmarc=none means no DMARC policy is published. Receivers cannot verify you at all, which increasingly means spam-foldered or rejected mail.

What it means

Gmail and Yahoo now require authentication for bulk senders, and many receivers penalise unauthenticated mail regardless of volume. none across the board is the weakest possible posture.

Why it happens

The domain was set up for web but never for mail, or you started sending through a new provider without publishing its records. Nothing is broken — it simply was never configured.

Diagnose it

Run the domain-health check below. It grades SPF, DKIM, DMARC, reverse DNS, TLS and blacklists in one pass and shows exactly which records are missing.

Fix it

1. Publish an SPF record naming every service that sends as your domain:

v=spf1 include:your-service.example ~all

2. Turn on DKIM at each sending service and publish the selector record it gives you.

3. Publish DMARC in monitoring mode and review the reports before tightening:

v=DMARC1; p=none; rua=mailto:dmarc@example.com