How to use it
- Enter your domain and select every service that sends mail with your address: your mailbox provider, but also newsletter tools, web shops and invoicing software.
- Copy the records into your DNS, at your domain registrar or hosting provider. Replace an existing SPF record rather than adding a second one.
- Turn on DKIM in your mail provider’s admin panel. DKIM keys are generated by the provider, so this tool can’t create them.
- After an hour or so, check the result with the e-mail domain check.
Rolling out DMARC safely
Start with p=none and a report address. Receivers then send daily reports of who sends mail with your domain, without blocking anything. When the reports only show your own services, move to quarantine, and later to reject. Skipping straight to reject can stop legitimate mail from a service you forgot.
DMARC reports are XML files. A report address on your own domain is the simplest start; dedicated report services make them readable.
Domains that never send mail
Parked domains and old brand names are popular for spoofing, precisely because nobody watches them. For those, the tool produces a set that refuses all mail in your name: an SPF record that allows no server, DMARC on reject, and optionally a “null MX” record that tells senders the domain accepts no mail.