Free tool / Record builder
The right records, built for you.
Enter your domain to start from what you have now, then tick the services that send your email. SPF lookups are counted live, so you never cross the limit of ten.
Records for wise.comEmail handled by Google Workspace
01 SPF — who may send as wise.com
Tick every service that sends email from an @wise.com address. We started from your current record. We added Google Workspace: it handles your email but was missing.
include:_u.wise.com._spf.smart.ondmarc.com
Counting DNS lookups…
- Type
- TXT
- Name / Host
@- Value
v=spf1 include:_u.wise.com._spf.smart.ondmarc.com include:_spf.google.com ~all
Keep exactly one record that starts with v=spf1: replace the old one rather than adding a second.
02 DMARC — what inboxes do with forgeries
- Type
- TXT
- Name / Host
_dmarc- Value
v=DMARC1; p=reject; rua=mailto:bb3c5ff6@inbox.ondmarc.com
Rollout: two to four weeks on Watch while reports show only your own services passing, then Quarantine, then Reject.
03 MTA-STS and TLS-RPT — encrypted delivery to you
- Type
- TXT
- Name / Host
_mta-sts- Value
v=STSv1; id=202611071326
And host this file at https://mta-sts.wise.com/.well-known/mta-sts.txt over HTTPS (it lists your current mail servers):
version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: aspmx2.googlemail.com
mx: aspmx3.googlemail.com
mx: alt1.aspmx.l.google.com
mx: alt2.aspmx.l.google.com
max_age: 86400- Type
- TXT
- Name / Host
_smtp._tls- Value
v=TLSRPTv1; rua=mailto:tls-reports@wise.com
Change the id in the _mta-sts record whenever you change the policy file, so senders fetch it again.
After publishing, run the inbox check to confirm. DNS changes usually apply within an hour.