Free tool · no signup
Write your SPF and DMARC in thirty seconds.
Tick the services that send email for you and get one valid SPF record, with its DNS lookup budget counted as you go. Then pick a DMARC policy and get the record to publish beside it.
Who sends email for your domain?
Options
Estimated DNS lookups
4 of 10
TXT record · host: @ (your domain)
v=spf1 include:_spf.google.com ~all- 1.On the SPF tab, select every service that sends email as your domain.
- 2.On the DMARC tab, start with Monitor and add an address for reports.
- 3.Publish both as TXT records, then confirm them with the deliverability checker.
One SPF record, never two
A domain may publish exactly one SPF record. Adding a second for a new tool is the most common mistake there is, and it makes SPF fail for every receiver. When you add a service, add its include to the existing record instead.
Each include costs DNS lookups, and SPF allows ten in total. Google Workspace alone uses several, so a domain with five or six sending tools can cross the limit without anyone noticing.
Rolling out DMARC without losing mail
Start with p=none and a report address. Reports show every service sending as your domain; fix the ones that fail SPF or DKIM. Then move to quarantine, optionally for a percentage of mail first, and to reject when the reports are clean.
Do this automatically
Leads Ranger audits SPF, DKIM, DMARC and MX on every mailbox you connect, then warms it up and watches its bounces.
Straight answers
Questions, answered.
v=spf1 include:_spf.google.com ~all. Add the includes for any other service that sends as your domain into the same record, before the ~all.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. It changes nothing about delivery and starts sending you reports. Move to p=quarantine once every legitimate sender passes.
~all (softfail) is the safe default while you are still finding every sender. -all (fail) is stricter and fine once you are sure the record is complete; with DMARC enforced, the practical difference is small.
Go deeper
Guides from the Ranger Playbook
Guide · 9 min read
SPF, DKIM and DMARC: The 20-Minute Setup That Decides Your Cold Email
A plain-English guide to the three DNS records every sender needs, what each one actually proves, how to set them up correctly, and the mistakes that quietly break them.
Read the guide→Guide · 10 min readSPF Too Many DNS Lookups: What Dynamic SPF Is and When You Need It
Why SPF breaks silently at ten DNS lookups, how to count yours, the four ways to fix it including flattening and dynamic SPF, and why DMARC without SPF is not the disaster it sounds like.
Read the guide→Guide · 9 min readDo I Need DMARC for Cold Email? Yes, and Here Is Exactly Why
What DMARC does, why Google and Yahoo made it effectively mandatory, which policy to start on, and the two mistakes that break legitimate mail the day you publish a record.
Read the guide→Free during the open pilot
Now find someone to send it to.
Leads Ranger finds local businesses with real emails, warms your mailboxes and runs the outreach. No credit card.
No credit card required
Free during the open pilot