From Spoofed to SecuredSetup Guides by Platform
Step-by-step SPF, DKIM, and DMARC instructions for the providers you already use — plus free tools to generate and check your records.
The Email Authentication Stack
Four layers that take a domain from spoofable to brand-verified. Implement them in order for the fewest surprises.
SPF
Authorize which servers can send mail for your domain.
DKIM
Cryptographically sign outbound messages so receivers can verify integrity.
DMARC
Set policy and reporting so spoofed mail can be monitored — then enforced.
BIMI
Show your brand logo in supporting inboxes (requires DMARC enforcement).
Guides by Platform
Choose your email provider. Open the guide when available, or use Generator and Checker while you follow DNS steps in your host’s console.
Coming soon
Why Generic Guides Fail
Copy-paste tutorials skip the details that actually break authentication on your stack.
DNS formatting quirks
Hosts disagree on quotes, TTL defaults, and multi-string TXT records — one wrong character and SPF or DMARC never publishes.
Multi-sender complexity
Marketing tools, CRMs, and support desks each need includes and keys. Generic guides rarely map your full sender inventory.
DKIM selector & key pitfalls
Wrong selectors, truncated public keys, or dual-provider signing leave mail unsigned while dashboards claim “DKIM is on.”
Free Tools to Build & Verify Records
Generate clean records, then validate them before you flip DMARC to quarantine or reject.
Start monitoring your DMARC reports free
No credit card required. See who sends as your domain and move from monitoring to enforcement with confidence.