Enter your domain to read its MX, SPF and DMARC records, then get the exact DNS entries to fix them. Everything runs in your browser: nothing is stored.
Tick every service that sends email with your domain in the From address. Detected providers are pre-selected after a check.
DKIM keys are created by your email provider, not by you. Follow the steps for each service, then check the record is published.
Start with p=none to monitor, then move to quarantine and reject once SPF and DKIM pass for all your senders.
Email was designed without any proof of who sent a message. SPF, DKIM and DMARC are three DNS records that add that proof. Receiving servers such as Gmail and Outlook read them on every message to decide whether it is genuine, suspicious or forged.
Since February 2024, Gmail and Yahoo require SPF or DKIM from every sender, and SPF, DKIM and a DMARC record from anyone sending more than 5,000 messages a day. Microsoft announced comparable rules for Outlook.com addresses in 2025. Mail that fails these checks is sent to spam or rejected.
Where to click, which records to publish and what usually goes wrong.
No. A domain must publish a single TXT record starting with v=spf1. Two records make SPF fail with a permanent error. Merge every service into one record, as the generator does. More on SPF.
SPF, DKIM and DMARC prove that mail really comes from you, but content, sending reputation, complaint rates and blocklists also matter. Fix authentication first, then look at the rest.
Google recommends ~all, Microsoft recommends -all. Start with ~all, and switch to -all once you are sure every legitimate sender is in the record.
Yes, if you send any volume. Gmail and Yahoo require SPF and DKIM plus a DMARC record from senders of more than 5,000 messages a day, and even small senders get better delivery with all three in place.
Open a message you sent, view its original headers, and look for the s= value in the DKIM-Signature header. Google Workspace uses google by default and Microsoft 365 uses selector1 and selector2.
Usually minutes, sometimes a few hours depending on the record's TTL. Run the check again later if a new record does not show up yet.
