SPF, DMARC, MTA-STS & BIMI Record Builder
Build the DNS records that stop people sending email as your domain, ready to copy into your DNS host. Tick the services you send from and we work out the SPF record, count its lookups and spot mistakes, then help you plan DMARC through to p=reject, add MTA-STS and BIMI, and lock down domains that never send email.
- SPF, DMARC, MTA-STS, BIMI
- Checks the 10-lookup limit
- Built in your browser
Records are built in your browser. Nothing you type is sent anywhere.
Who sends email for you?
Tick every service that sends email with your domain in the From address. Some don't need SPF at all; we'll say so.
Your own servers and other senders
Start from your current SPF record
Find it with our Email Security Checker or DNS Checker (the TXT record at your domain starting v=spf1).
Your SPF record
DMARC policy
DMARC tells receivers what to do with mail that fails SPF and DKIM for your domain, and where to send reports.
Advanced settings
Your DMARC record
A safe path to p=reject
Move one step at a time and read your reports between steps. Each record below uses your settings above.
MTA-STS and TLS reporting
MTA-STS tells other mail servers to deliver to you only over an encrypted, verified connection, which stops attackers quietly downgrading or intercepting it. TLS reporting sends you daily reports of any problems.
Find your MX hosts with our DNS Checker (record type MX). A pattern such as *.example.com covers one level of names below it.
Your records and policy file
BIMI: your logo in the inbox
BIMI lets mail apps such as Gmail, Apple Mail and Yahoo show your logo next to your emails, but only once DMARC is enforced.
Your BIMI record
Lock down a domain that never sends email
Spare and parked domains are easy to spoof because nobody watches them. These four records tell every receiver that no email from this domain is genuine, as recommended in the UK government's guidance for domains that don't send email.
- Only use this for a domain that sends no email at all, including website forms, invoices and newsletters.
- The null MX record means the domain can't receive email either. Delete any other MX records first.
- The DKIM record is blank on purpose: it cancels any signature claiming to be from this domain. Remove old DKIM keys too.
Records for a parked domain
How the three records work together
- SPF lists the servers allowed to send for your domain. It checks the hidden "envelope" sender, and breaks when mail is forwarded.
- DKIM adds a digital signature. Each service gives you its own DKIM records to add, usually CNAMEs, so they aren't built here.
- DMARC checks that SPF or DKIM passed for the domain in the From line, and tells receivers what to do when neither did.
- Gmail and Outlook.com require SPF, DKIM and DMARC (p=none at least) from anyone sending more than 5,000 emails a day to their users, and Yahoo has similar rules for bulk senders. Mail that fails can be junked or rejected.
Common SPF mistakes
- Two SPF records. A domain must have only one TXT record starting v=spf1. Two make SPF fail completely, so merge them.
- More than 10 lookups. Each include, a, mx, exists and redirect costs at least one DNS lookup, and includes inside includes count too. Go over 10 and SPF fails.
- Including services that don't need it. Many senders, such as Mailchimp, Brevo and Postmark, pass SPF with their own bounce address. They need DKIM set up instead.
- After you publish, check it with our Email Security Checker, and read the DMARC reports with the DMARC Report Analyser.
Lookup counts are what each provider's record used when we checked in October 2026. Providers change them, so check your live record after publishing.