Free tools

Email Setup Wizard

Tell it who hosts your mailboxes and which services send as your domain. It writes the MX, SPF, DKIM and DMARC records for you, counts the SPF lookups so the record does not silently break, stages DMARC from monitoring to reject, and verifies the result once you have published it.

Agent-ready This page publishes the WebMCP tool generate_mail_records, so an AI agent in your browser can generate the records and read the JSON back instead of filling in the form. How it works

Where are the mailboxes?

What else sends email as this domain? (apps, newsletters, CRM, transactional)

A mailbox you will read, or a DMARC report service address. Defaults to dmarc@your-domain.

Where are you in the rollout?

Why one wizard instead of four articles

Each provider documents its own record and none of them mention the others. The result is an SPF record with eleven lookups that receivers silently ignore, DKIM enabled for the mailbox but not the newsletter tool, and a DMARC record at p=none for three years because nobody knew what the next step was. This page starts from the list of senders, writes the records that cover all of them, tells you when the SPF budget runs out, and gives you the next DMARC step with a date attached.

The rollout, in order

1. SPF with ~all, listing every sender. Soft fail during setup so a missed sender is junked, not lost. 2. DKIM for every provider, then turn signing on in each console. DKIM is what makes DMARC survive forwarding and mailing lists, so do not skip the small senders. 3. DMARC at p=none with a rua= address, then read the aggregate reports for two to four weeks. Anything legitimate that fails alignment gets fixed now. 4. p=quarantine with pct=25, raising pct as reports stay clean. 5. p=reject, sp=reject for subdomains, strict alignment, and SPF flipped to -all. Run the deliverability checker after each step, or let a mail monitor tell you when something changes under you.

Notes on the estimates

The SPF lookup count is an estimate from each provider's published include at the time of writing; providers restructure them occasionally, so the verifier below counts the real thing after you publish. DKIM values that come from a provider console are shown as placeholders with the selector names each provider uses, and the exact value has to be copied from that console because it is generated per account.

Then keep it that way

Records drift: a teammate edits SPF, a provider rotates keys, a shared IP lands on a blocklist. AlertKick's mail monitor re-checks SPF, DMARC, DKIM and five blocklists every hour and alerts when the grade drops or a record changes. Free to start.

Monitor my mail setup - free