Answer a few questions about who sends email for you, then copy the two records into your DNS settings. The defaults are safe: nothing is blocked until you choose to block it.
Free · No sign-up · Nothing stored
for yourbusiness.com
v=spf1 include:_spf.google.com ~allLists the services allowed to send email as yourbusiness.com. Inboxes check it to spot email from anywhere else. You can only have one, so this replaces any existing SPF record.
SPF lookups: about 1 of 10
v=DMARC1; p=noneTells inboxes what to do when an email uses your name but fails the checks, and where to send reports. With p=none nothing is blocked yet; you're watching first.
These records don't include DKIM. Switch it on in each email service; they give you their own DKIM records to add.
Send the records to whoever manages your domain. The link opens a fresh check of yourbusiness.com.
Every include comes from the provider's own documentation, checked on the date shown. Services marked "No SPF change needed" say so in their own guides.
A DMARC record is a TXT record at _dmarc.yourbusiness.com, for example v=DMARC1; p=quarantine; rua=mailto:dmarc@yourbusiness.com.
Every service that sends email as you (your inbox provider, newsletters, your shop, your helpdesk) goes into the same SPF record as an include. The generator combines them and keeps any servers your current record already lists, so publishing it replaces your old record without losing a sender.
Not if you go in the right order. A correct SPF record and a DMARC policy of p=none change nothing about delivery; they just add checks and reports. Problems come from leaving a sending service out of SPF and then jumping straight to p=reject. Start with p=none, read the reports, then tighten.
Usually where you bought the domain (GoDaddy, Namecheap, IONOS and so on), your website host, or Cloudflare if you use it. The menu may be called DNS records, Zone editor or Advanced DNS. Not sure who manages it? Your domain's nameservers tell you, and your web developer or IT provider will know.
Paste each value exactly as the generator shows it, without extra quotation marks unless your provider asks for them. For the host, most providers want @ (or a blank field) for SPF and _dmarc for DMARC. A few want the full name, such as _dmarc.yourbusiness.com.
Usually minutes to an hour. Some providers and cached results take up to 48 hours. Run the checker after an hour; if the old record still shows, wait and try later.
Because most businesses have senders they've forgotten: a website form, an invoicing tool, a newsletter. p=none blocks nothing but sends you reports. After two to four weeks, once every real sender passes, move to p=quarantine and then p=reject. That last step is the one that protects your customers.
No. The standard allows one. Two SPF records make every SPF check fail. Combine them into one record with an include: for each service. The generator above does this for you.
We'll find every service that sends email as you, publish the right records and take you from monitoring to full protection without blocking your own email.
Free consultation. No obligation and no sales script.
Change theme