Free tool / Record builder
The right records, built for you.
Enter your domain to start from what you have now, then tick the services that send your email. SPF lookups are counted live, so you never cross the limit of ten.
Records for github.comEmail handled by Microsoft 365
01 SPF — who may send as github.com
Tick every service that sends email from an @github.com address. We started from your current record.
include:_netblocks.google.cominclude:_netblocks2.google.cominclude:mktomail.comip4:192.30.252.0/22ip4:62.253.227.114ip4:166.78.69.169ip4:166.78.69.170ip4:166.78.71.131
Counting DNS lookups…
- Type
- TXT
- Name / Host
@- Value
v=spf1 ip4:192.30.252.0/22 ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ~all
Keep exactly one record that starts with v=spf1: replace the old one rather than adding a second.
02 DMARC — what inboxes do with forgeries
- Type
- TXT
- Name / Host
_dmarc- Value
v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc@github.com
Rollout: two to four weeks on Watch while reports show only your own services passing, then Quarantine, then Reject.
03 MTA-STS and TLS-RPT — encrypted delivery to you
- Type
- TXT
- Name / Host
_mta-sts- Value
v=STSv1; id=202611071312
And host this file at https://mta-sts.github.com/.well-known/mta-sts.txt over HTTPS (it lists your current mail servers):
version: STSv1
mode: testing
mx: github-com.mail.protection.outlook.com
max_age: 86400- Type
- TXT
- Name / Host
_smtp._tls- Value
v=TLSRPTv1; rua=mailto:tls-reports@github.com
Change the id in the _mta-sts record whenever you change the policy file, so senders fetch it again.
After publishing, run the inbox check to confirm. DNS changes usually apply within an hour.