diff --git a/backend/app/services/dns_resolver.py b/backend/app/services/dns_resolver.py
index a2a235f..096aa0b 100644
--- a/backend/app/services/dns_resolver.py
+++ b/backend/app/services/dns_resolver.py
@@ -15,6 +15,22 @@ from typing import List, Optional, Tuple
 logger = logging.getLogger(__name__)
 
 
+def _sanitize_for_log(value: Optional[str]) -> str:
+    """
+    Return a log-safe representation of *value* by removing newline and
+    carriage-return characters that could be used for log injection.
+
+    This is only used for logging; the original value should still be used
+    for functional behavior such as DNS lookups.
+    """
+    if value is None:
+        return ""
+    # Ensure we are working with a string, then strip CR/LF characters
+    text = str(value)
+    return text.replace("\r", "").replace("\n", "")
+
+
+
 def _sanitize_for_log(value: str) -> str:
     """
     Remove characters that could be used for log injection from a string.
@@ -108,8 +124,13 @@ class BaseDNSProvider(ABC):
             safe_domain = _sanitize_for_log(domain)
             logger.debug("SPF lookup failed for %s: %s", safe_domain, exc)
     async def check_spf(self, domain: str) -> Tuple[bool, Optional[str]]:
+                safe_selector = _sanitize_for_log(selector)
+                safe_domain = _sanitize_for_log(domain)
         """Return *(found, record_string)* for the domain's SPF TXT record."""
-        try:
+                    "DKIM lookup failed for selector=%s domain=%s: %s",
+                    safe_selector,
+                    safe_domain,
+                    exc,
             records = await self.lookup_txt(domain)
             for record in records:
                 if record.lower().startswith("v=spf1"):