Tell it who hosts your mailboxes and which services send as your domain. It writes the MX, SPF, DKIM and DMARC records for you, counts the SPF lookups so the record does not silently break, stages DMARC from monitoring to reject, and verifies the result once you have published it.
generate_mail_records, so an AI agent in your browser can generate the records and read the JSON back instead of
filling in the form. How it works
Each provider documents its own record and none of them mention the others. The result is an SPF record with eleven lookups that receivers silently ignore, DKIM enabled for the mailbox but not the newsletter tool, and a DMARC record at p=none for three years because nobody knew what the next step was. This page starts from the list of senders, writes the records that cover all of them, tells you when the SPF budget runs out, and gives you the next DMARC step with a date attached.
1. SPF with ~all, listing every sender. Soft fail during setup so a missed sender is junked, not lost. 2. DKIM for every provider, then turn signing on in each console. DKIM is what makes DMARC survive forwarding and mailing lists, so do not skip the small senders. 3. DMARC at p=none with a rua= address, then read the aggregate reports for two to four weeks. Anything legitimate that fails alignment gets fixed now. 4. p=quarantine with pct=25, raising pct as reports stay clean. 5. p=reject, sp=reject for subdomains, strict alignment, and SPF flipped to -all. Run the deliverability checker after each step, or let a mail monitor tell you when something changes under you.
The SPF lookup count is an estimate from each provider's published include at the time of writing; providers restructure them occasionally, so the verifier below counts the real thing after you publish. DKIM values that come from a provider console are shown as placeholders with the selector names each provider uses, and the exact value has to be copied from that console because it is generated per account.
Records drift: a teammate edits SPF, a provider rotates keys, a shared IP lands on a blocklist. AlertKick's mail monitor re-checks SPF, DMARC, DKIM and five blocklists every hour and alerts when the grade drops or a record changes. Free to start.
Monitor my mail setup - free