Email Setup Wizard

Set up email authentication with our guided wizard. Configure SPF, DKIM, and DMARC records step-by-step to protect your domain from spoofing.

Advertisement

Understanding Email Authentication

Email authentication is your first line of defense against email spoofing and phishing attacks. Without it, anyone can send emails that appear to come from your domain.

The Three Pillars

SPF (Sender Policy Framework) SPF is a TXT record in your DNS that lists all servers authorized to send email for your domain.

DKIM (DomainKeys Identified Mail) DKIM adds a cryptographic signature to your outgoing emails. The receiving server uses a public key in your DNS to verify this signature.

DMARC (Domain-based Message Authentication, Reporting & Conformance) DMARC tells receiving servers what to do when emails fail SPF or DKIM. It also provides reporting.

The DMARC Journey

  1. Monitor (p=none): Receive reports, do not affect delivery
  2. Quarantine (p=quarantine): Send failing emails to spam
  3. Reject (p=reject): Block failing emails entirely

Common Mistakes to Avoid

  • Too many SPF lookups: SPF allows maximum 10 DNS lookups
  • Forgetting marketing tools: Services like Mailchimp need to be in your SPF
  • Jumping to DMARC reject: Always start with monitoring
  • Not monitoring reports: DMARC reports reveal authentication issues
From the Inventive HQ family
OmniCanvas Notes
Visual thinking on an infinite canvas.

Notes, sketches and ideas laid out spatially instead of in a list. For people who think in diagrams and keep outgrowing linear note apps.

Take a look

Frequently Asked Questions

What is email authentication?+

Email authentication consists of SPF, DKIM, and DMARC - three DNS-based protocols that verify emails are legitimately from your domain. They help prevent email spoofing and phishing attacks.

Why do I need SPF, DKIM, and DMARC?+

Each protocol serves a different purpose: SPF specifies which servers can send email for your domain, DKIM adds a digital signature to verify message integrity, and DMARC tells receiving servers what to do with emails that fail authentication.

What order should I set up email authentication?+

We recommend: 1) SPF first - simplest and most widely supported, 2) DKIM second - requires coordination with your email provider, 3) DMARC last - it relies on SPF and DKIM being configured.

How long does DNS propagation take?+

DNS changes typically propagate within 1-4 hours, but can take up to 48 hours. If your records don't verify immediately, wait a few hours and check again.

What DMARC policy should I start with?+

Start with policy "none" (monitoring mode) to receive reports without affecting email delivery. Gradually move to "quarantine" then "reject" after verifying SPF and DKIM work correctly.

Why can't the wizard generate DKIM keys for me?+

DKIM requires a private key that must be securely stored on your email server. This setup is provider-specific - Google Workspace, Microsoft 365, and other providers each have their own DKIM configuration process.

What if I use multiple email services?+

Include all your email services in your SPF record using "include:" mechanisms. Each service should have its own DKIM selector configured.

How do I read DMARC reports?+

DMARC aggregate reports are XML files sent to the email address in your "rua" tag. Free services like DMARC Analyzer or Postmark's DMARC tool can parse these reports into readable dashboards.

This tool is provided for informational and educational purposes only. All processing happens in your browser — no data is sent to or stored on our servers. While we strive for accuracy, we make no warranties about the completeness or reliability of results.