Keep your email out of spam.

SPF lists the services allowed to send email as your domain. DMARC tells receivers what to do when an email fails that check - deliver it, send it to spam or block it - and sends you reports on who is sending as you. Together with DKIM, they keep your email out of spam and stop others from spoofing your domain.

Every service that sends email with your domain in the From address: your mailbox provider, newsletter and marketing tools, your CRM, helpdesk and website forms. If a service isn’t in the list, add the include from its setup guide under other senders - each provider’s documentation is the final word.

Start with ~all, which marks email from unlisted servers as suspicious. Once DMARC reports show every real sender passing, -all tells receivers to reject the rest outright. With DMARC in place the difference is small, so ~all is the safer default.

p=none only monitors, so nothing you send gets blocked while you find every service sending as you. Watch the reports for a few weeks, fix any sender that fails, then move to p=quarantine and finally p=reject.

Receivers stop checking SPF after 10 DNS lookups, and the whole check fails past that point. Every include, a and mx counts - and providers’ includes often contain more lookups of their own. Remove services you no longer use, and run the Email Domain Checker after publishing to see the real total.

In your DNS provider - often your domain registrar or host. Add each one as a TXT record: SPF at the root of your domain (usually entered as @) and DMARC at _dmarc. A domain can only have one SPF record, so replace your existing one instead of adding a second.

DKIM signs your email with a key that only your sending service holds, so each service generates it for you - look for "authenticate your domain" in its settings. The Email Domain Checker tells you whether it is set up.

No. The records are built in your browser. If you load your current records, we only read your public DNS - nothing is saved.