Build the records. Then publish them.

Tick every platform that sends email as your domain and the SPF record is written for you, with the DNS lookup count so it stays under the limit. Set the DMARC policy you are ready for and get that record too. Everything runs in your browser.

Before you publish

Run the email health check on your domain first. Replace the existing SPF record rather than adding a second one; two SPF records is the same as none.

1. Your domain

Domain the mail is sent from

2. Who sends as this domain

Include every platform that sends with your domain in the From address: mail, marketing, invoicing, CRM, helpdesk, e-signature, e-commerce.

Your own mail server IPs (optional, one per line or comma-separated)

Custom includes (e.g. from HubSpot or your ISP)

Allow the servers in our MX records to send (mx) Allow the web server's address to send (a)

Unlisted senders

-all reject (recommended) ~all softfail (while testing)

3. DMARC policy

Start at none to collect reports, move to quarantine when every sender above passes, then reject.

none monitor quarantine spam folder reject refuse

Aggregate reports to (rua)

Failure reports to (ruf, optional)

Apply to (% of failing mail)

Subdomain policy (sp)

Strict DKIM alignment (adkim=s) Strict SPF alignment (aspf=s)

SPF record

TXT record at yourdomain.com.au

DMARC record

TXT record at _dmarc.yourdomain.com.au

DKIM: where each key lives

SPF and DMARC are DNS records you write. DKIM keys are generated by each platform; publish what each one gives you.

Published the records? Run the email health check to confirm ›

How to publish the records

Both records are TXT records in the DNS zone for your domain, at whichever provider the domain overview shows as your DNS host. The SPF record goes at the root of the zone (often shown as @); the DMARC record goes at the host name _dmarc. Changes take effect within the record's TTL, usually an hour or less.

The order that does not break mail

Publish SPF with ~all and DMARC with p=none and a reporting address.
Enable DKIM in every platform listed and publish the keys.
Read two to four weeks of aggregate reports. A free or paid DMARC reporting service makes them readable. Every legitimate sender should show SPF or DKIM passing with alignment.
Move to p=quarantine, then p=reject, and change SPF to -all.

Common questions

The generator says my record is close to ten lookups. What do I do?

Remove platforms you no longer use, replace includes with ip4 entries for services with fixed addresses, or move bulk marketing mail to a subdomain such as news.yourdomain.com.au with its own SPF record. The health check counts nested includes precisely.

Does our website contact form need to be in SPF?

Only if it sends mail with your domain in the From address directly from the web server. Forms that send through Microsoft 365, Google Workspace or a transactional service are covered by that service's include.

We use HubSpot. Why is there no include for it?

HubSpot issues an account-specific SPF include and DKIM records when you connect a sending domain. Copy the include it shows into the custom box.

Email health check Microsoft 365 lookup

Next step

Want it rolled out without blocking real mail?

We inventory every sender, publish the records, enable DKIM in each platform, read the reports and step the policy up to reject when the evidence says so.

Discuss Your Environment Email and identity security