Free tool / Record builder
The right records, built for you.
Enter your domain to start from what you have now, then tick the services that send your email. SPF lookups are counted live, so you never cross the limit of ten.
Records for zalando.com
You’ve loaded many domains in a few minutes, so this one starts empty.
01 SPF — who may send as zalando.com
Tick every service that sends email from an @zalando.com address. You have no SPF record yet.
Counting DNS lookups…
- Type
- TXT
- Name / Host
@- Value
v=spf1 ~all
Keep exactly one record that starts with v=spf1: replace the old one rather than adding a second.
02 DMARC — what inboxes do with forgeries
- Type
- TXT
- Name / Host
_dmarc- Value
v=DMARC1; p=none; rua=mailto:dmarc@zalando.com
Rollout: two to four weeks on Watch while reports show only your own services passing, then Quarantine, then Reject.
03 MTA-STS and TLS-RPT — encrypted delivery to you
- Type
- TXT
- Name / Host
_mta-sts- Value
v=STSv1; id=202611071314
And host this file at https://mta-sts.zalando.com/.well-known/mta-sts.txt over HTTPS:
version: STSv1
mode: testing
mx: mail.zalando.com
max_age: 86400- Type
- TXT
- Name / Host
_smtp._tls- Value
v=TLSRPTv1; rua=mailto:tls-reports@zalando.com
Change the id in the _mta-sts record whenever you change the policy file, so senders fetch it again.
After publishing, run the inbox check to confirm. DNS changes usually apply within an hour.