DMARC record generator
The three DNS records a sending subdomain needs, with the two mistakes people actually make taken out: pointing DMARC at the wrong host, and starting on a policy you cannot support yet.
_emailssh.agents.yourcompany.com
emailssh-verify=<token from the dashboard>
agents.yourcompany.com
10 inbound-smtp.eu-west-1.amazonaws.com
agents.yourcompany.com
v=spf1 include:amazonses.com ~all
_dmarc.agents.yourcompany.com
v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com; fo=1; adkim=s; aspf=s
<token>._domainkey.agents.yourcompany.com
<token>.dkim.amazonses.com
Three DKIM CNAMEs, issued when you add the domain. They cannot be derived from the name, and a domain is not activated until they resolve and a signature is confirmed.
Monitoring only. Nothing is rejected, and the reports tell you who else sends as this domain. Start here for two weeks.
Send agents from their own subdomain
Reputation is tracked per sending domain. Putting agents on agents.yourcompany.com rather than the domain your people send from
means an agent's bad week cannot take your invoices down with it, and it lets you publish strict
alignment, because nothing else sends from there.
Published records and passing messages are two different claims. Once these are live, check a real message with the header analyzer.
Read the full guide to agent subdomain authenticationOr let the wizard do the DNS.
Add your domain, paste the records it gives you, and it checks each one as it resolves. While you wait you can send from onboarding@emails.sh, so nothing is blocked on a TTL.
3,000 emails a month, free, no credit card.