Guides
How to fix what the DomainRef check finds, with example records.
- SPF: Fix SPF step by step: one v=spf1 record, the 10 DNS lookup limit, Microsoft 365 and Google Workspace includes, ~all vs -all, and domains that send no mail.
- DKIM: Set up DKIM signing: Microsoft 365 selector1 and selector2 CNAMEs, the Google Workspace google._domainkey key, other senders, 2048-bit keys and how to check them.
- DMARC: Roll out DMARC safely: publish p=none with reports, align SPF and DKIM for every sender, then move to p=quarantine and p=reject. Example records included.
- MTA-STS and TLS-RPT: Set up MTA-STS so sending servers must use TLS to your MX, plus TLS-RPT reports: the _mta-sts TXT record, the policy file, testing then enforce mode.
- DNSSEC: Turn on DNSSEC safely (sign at your DNS host, then publish the DS at the registrar) and fix the SERVFAIL caused by a DS that no longer matches your keys.
- BIMI: Set up BIMI step by step: DMARC at enforcement, an SVG Tiny PS logo, the default._bimi TXT record, and a VMC or CMC mark certificate with its full chain.
- Blacklist check: Check whether your mail server IP is on a DNS blocklist (DNSBL): find your sending IPs, query the list over DNS, read the answer, and get delisted.
Check a domain: see how to call the check.