I am launching a new website
Check the domain resolves on both the bare name and www, the certificate covers both, and email is not left open to spoofing.
AltF DomainOps
Email domain setup guide: MX, SPF, DKIM and DMARC
Since 2024, Gmail and Yahoo require bulk senders to have SPF, DKIM and DMARC, and every serious mailbox provider uses them to decide what reaches the inbox. This guide sets them up in order, with the exact record formats and a DomainOps check after each step.
- Free, no sign-up
- Real DNS, RDAP and TLS data
- Raw records shown
- No affiliate links
Step 1: MX
Add the MX records your mail provider gives you and remove any from a previous provider. Check with the MX lookup: the provider name should appear next to the records.
Step 2: one SPF record
- Publish exactly one TXT record at the bare domain that starts with v=spf1.
- Add an include: for each service that sends as you (mail provider, newsletter tool, CRM, help desk).
- End with ~all while testing, -all when you are sure the list is complete.
- Keep it under 10 DNS lookups. The Email DNS tab counts them for you, include by include.
Step 3: DKIM
Turn on DKIM signing in each sending service. Each gives you a selector and a TXT or CNAME record at selector._domainkey. Type the selector into the Email DNS tab to confirm the key is published.
Step 4: DMARC in three stages
- Week 1: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Read the aggregate reports to find every sender.
- Week 3-4: p=quarantine once all your real senders pass SPF or DKIM in alignment.
- Then: p=reject. Spoofed mail is now refused outright.
Step 5: optional extras
- MTA-STS (_mta-sts TXT plus a policy file) to require TLS for mail delivered to you.
- TLS-RPT (_smtp._tls TXT) to receive reports on failed encrypted deliveries.
- BIMI (default._bimi TXT) to show your logo in supporting inboxes; needs DMARC at quarantine or reject.
Check each step with the tools below.
Email domain setup guide: questions and answers
Can I have two SPF records?
No. Two v=spf1 records make SPF fail with a permanent error for every message. Merge all the includes into a single record.
Do I need DMARC if I only use Gmail or Outlook?
Yes, if you send from your own domain. Google and Yahoo require a DMARC record for bulk senders, and without one anyone can spoof your domain with no way for you to see it.
Which tool should I use for a quick SPF, DKIM and DMARC pass/fail?
The SPF, DKIM and DMARC checker tool on AltFTool gives a fast single-page verdict. The Email DNS tab here adds SPF lookup counting, DKIM selector probing and MTA-STS, TLS-RPT and BIMI.
Start from what you are doing
My email goes to spam
Read your SPF, DMARC and DKIM records, make sure SPF stays under 10 lookups, and confirm MX points at the right provider.
I am moving to a new host
Lower TTLs first, copy every record, switch nameservers, then compare resolvers until the new answers appear everywhere.
My site shows a certificate error
See whether the certificate expired, does not cover this hostname, or is missing an intermediate in the chain.
I do not want to lose my domain
Find the real expiry date, check transfer lock is on, and keep the domain on a watchlist with a countdown.
A service asked me to add a TXT record
Confirm the verification record is live, see which services already verified the domain, and spot leftovers to remove.
Focused checks and guides
Checks
Full domain health checkAll nine tools, the record glossary and how each check works.DNS lookupFree DNS lookup for A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, DS, DNSKEY and HTTPS records, with TTLs, DNSSEC status and what each record means.MX lookupFree MX record lookup: see a domain's mail servers in priority order, which email provider runs them, and whether SPF and DMARC are set.NS lookupFree nameserver lookup: see which nameservers answer for a domain, who the DNS host is, the SOA serial, and whether the zone is DNSSEC-signed.TXT record lookupFree TXT record lookup that labels each record: SPF, Google and Microsoft verification, Meta, Apple, Stripe and 25 more services, plus DMARC and DKIM.SSL certificate checkFree live SSL checker: connect to any site and see its certificate issuer, expiry date and days left, covered hostnames, chain trust and TLS version.Domain expiry checkCheck when a domain expires from the registry's own RDAP data: expiry date, days left, registrar, transfer lock and status codes in plain English.Reverse DNS lookupFree reverse DNS lookup for IPv4 and IPv6: find the PTR hostname of an IP address and the network owner from the regional internet registry.DNSSEC checkCheck whether a domain uses DNSSEC: DS record at the registry, DNSKEY in the zone and whether public resolvers validate the answers.CAA record checkLook up a domain's CAA records to see which certificate authorities may issue certificates, including wildcard and reporting rules, with fixes.
Guides
Domain launch checklistA 20-point checklist to launch a new domain: DNS records, www, HTTPS, email authentication, DNSSEC, CAA, registrar lock, with a free check for each step.Website migration DNS checklistMove a website or DNS to a new host without downtime: lower TTLs, copy records, switch nameservers, watch resolvers, handle DNSSEC and email.
25 more free domain and DNS tools
Single-purpose AltFTool tools for one job each, grouped by what you are trying to do.
Lookups
One question, one answer.
Write records
Generate correct records before you paste them into your DNS host.
Certificates and HTTPS
Go deeper than the live certificate check.
AltFTool does not store the domains or addresses you check. DNS lookups in the DNS, compare, email and IP tools run from your browser; registration, report and certificate checks pass through AltFTool's server and keep nothing.