Sender inventory
Every mailbox, app, and platform that sends as your domain, with how it authenticates today and who owns it.
The Problem
Your Own Invoices Are Failing the Checks Inboxes Run on You
It shows up after a new tool goes live. Someone adds a second SPF entry for the CRM, or the help desk sends unsigned mail, and replies start landing in spam.
Two records
A setup guide told you to add a second SPF line.
Two records
Both records merge into one, so receivers stop returning a permerror for your domain.
Lookup limit
Too many includes push the record past 10 DNS lookups.
Lookup limit
We trim includes and move bulk senders to a subdomain with its own record.
Unsigned apps
Your invoicing app sends as you with no DKIM signature.
Unsigned apps
Each app gets its own key, published in DNS and switched on in the app.
Old keys
A 1024-bit key from years ago still signs your mail.
Old keys
Keys move to 2048 bits where the tool supports it, and the old selector is retired.
You added a help desk last spring, and its setup guide told you to add an SPF record. You already had one, so now your domain has two, and receivers treat both as broken. Your invoicing app sends as you without a DKIM signature. Your Microsoft 365 include sits next to five others, so the record needs more than 10 DNS lookups. Nobody notices until a client says your invoice went to junk. Then someone edits DNS on a Friday afternoon and makes it worse.
We start with a list of every service that sends as your domain, taken from DNS, message headers, and your billing. Then we merge everything into one record that stays under the lookup limit, moving marketing tools to a subdomain when they don't fit. Each sender gets its own DKIM key, published and switched on in that tool. We test real messages before handover, so you hear about problems in our report, not from a client.
Every sender found first
DNS, message headers, and your billing show which tools send as your domain today.
One record, under 10 lookups
Duplicate records get merged and includes trimmed, so receivers can evaluate your record without a permerror.
A signing key per tool
Microsoft 365, Google Workspace, and each app that sends as you sign with their own key.
Our SPF and DKIM Setup Process
From Sender Inventory to Signed Mail in Five Clear Steps
You see the sender list before any DNS change, approve each record on a change sheet, and get test results from real messages at the end. Nothing in DNS changes without your sign-off.
We read your current SPF, DKIM, and MX records and count the lookups your current setup needs today. You get a short note on what is broken and a fixed price. If your record only needs one include changed, we'll tell you before we quote and show you the edit.
What's Included
What You Get: A Clean DNS SPF Record and a DKIM Record per Sender
You get one SPF policy per domain and a signing key for every tool that sends as you. Test results from real inboxes and a record sheet your next admin can follow come with it.
Compare Options
DeveloperLook vs DIY setup vs Freelancer
Following each vendor's setup guide works for a domain with one or two senders. Here is where DIY and a one-off freelancer fit, and where a full sender inventory pays off.
| Feature | DeveloperLookBest fit | DIY setup | Freelancer |
|---|---|---|---|
| Finding every sender | From DNS, headers, and billing | Only the tools you remember | Usually the senders you list |
| Duplicate SPF entries | Merged into one record | Each new guide adds another | Fixed if someone spots them |
| 10-lookup limit | Counted and kept under 10 | Rarely counted | Sometimes flattened by hand |
| Signing coverage | Every sender, own selector | Main mailbox only | Main mailbox and one app |
| Cost for one sender | From $350, fixed price | Free, apart from your time | Often cheaper by the hour |
| Speed on simple domains | 1 to 2 weeks, tested | Same day if it's simple | A day or two |
| Testing | Headers read in Gmail and Outlook | Often skipped | One test message |
| Documentation | Record sheet and sender list | Notes in someone's inbox | Depends on the person |
DeveloperLook
DIY setup
- Finding every sender
- DeveloperLook: From DNS, headers, and billingDIY setup: Only the tools you remember
- Duplicate SPF entries
- DeveloperLook: Merged into one recordDIY setup: Each new guide adds another
- 10-lookup limit
- DeveloperLook: Counted and kept under 10DIY setup: Rarely counted
- Signing coverage
- DeveloperLook: Every sender, own selectorDIY setup: Main mailbox only
- Cost for one sender
- DeveloperLook: From $350, fixed priceDIY setup: Free, apart from your time
- Speed on simple domains
- DeveloperLook: 1 to 2 weeks, testedDIY setup: Same day if it's simple
- Testing
- DeveloperLook: Headers read in Gmail and OutlookDIY setup: Often skipped
- Documentation
- DeveloperLook: Record sheet and sender listDIY setup: Notes in someone's inbox
Projects We've Built
Business Websites and Platforms We Have Built
These are website and platform builds for professional services firms, not email projects. Each one sends contact forms and notices from its own domain.
Herile IT Agency Web Design & Development
- Agency
- Website
Armada AG Fiduciary and Consulting Services Website
- Finance
- Business
- Website
NextEdge Startup Web Design & Development
- Startups
- Technology
- Business
EverTrust Insurance Web Design & Development
- Insurance
- Dashboard
- Website
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built apps, platforms, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why IT Teams Trust Us With SPF and DKIM Setup
A DNS mistake can stop mail for the whole company, so we work in small, reversible steps. These habits keep your mail flowing while the records change.
Old records stay until tested
We keep the old record live until the new one resolves and passes a test. Mail keeps flowing through the change, and rolling back takes one edit.
Lookups counted, not guessed
We count every nested include before publishing, including the ones vendors add inside their own records. You see the number on the change sheet next to the record.
Headers over checker tools
We trust the Authentication-Results header in a real inbox over any online checker. That header shows what Gmail and Outlook actually decided about your message.
Your admin stays in charge
Records go in under your own DNS account, and we can guide your admin instead of asking for logins. You keep full control of the domain the whole time.
Small fixes get small answers
If one include is wrong, we show you the fix instead of selling a project. You only pay us when the domain really needs an inventory and new records.
A sheet the next admin reads
Every record, selector, and sending tool goes on one sheet with its owner. When you add a tool next year, your admin knows where its record goes.
Overview
What is an SPF record in email authentication?
DeveloperLook sets up the SPF record and DKIM signing for domains on Microsoft 365, Google Workspace, and the apps that send as them. We list every sender, merge duplicates into one entry under the 10-lookup limit, and publish a key per tool. Setup starts at $350, most domains are done in 1 to 2 weeks, and you get test results from real inboxes.
DEVELOPERLOOK
Project facts · SPF and DKIM Setup
- Service
- SPF and DKIM Setup (sender inventory, merged SPF, DKIM signing, inbox tests)
- Typical timeline
- 1 to 2 weeks for one domain, 2 to 3 weeks for up to 10
- Platforms
- Microsoft 365, Google Workspace, and the apps that send as you
- Built with
- DNS TXT and CNAME records, DKIM selectors, and Gmail and Outlook header checks
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 days of support after handover
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $350 USD, fixed scope after a free DNS check
Reviewed 27 Oct 2026 by Saimul Islam
Good fit
IT teams cleaning up a messy domain
Your domain shows multiple SPF records from different setup guides, and you need one correct record before mail starts bouncing.
Microsoft 365 businesses adding apps
You run mail on Microsoft 365 and keep adding apps that send as you, so your Microsoft 365 SPF record needs room for them.
Google Workspace teams with unsigned mail
Your Gmail headers show DKIM signed by a Google default domain instead of yours, and you want your own key in place.
Companies told to fix authentication
Your email provider, a client's IT team, or a bounce message says your mail failed SPF or DKIM, and you need it fixed this month.
Agencies managing client domains
You manage DNS for several client domains and want SPF and DKIM done the same way on each one, under your agency's name.
Not a fit
You need DMARC enforcement
Your SPF and DKIM are already clean, and now you need a DMARC policy moved to quarantine or reject. Our DMARC Setup Services page covers that staged work.
Logo in the inbox
Your records are fine and the real goal is your brand logo next to your emails. BIMI Setup Services covers the logo file and the certificate.
Bulk sender rules only
Your problem is meeting the Gmail and Yahoo bulk sender rules across Klaviyo or Mailchimp. Google and Yahoo Sender Rules Compliance is the better fit for that.
A single include to add
Your record only needs one include added for a new tool, which is below our $350 starting scope. The tool's own guide covers it, and we'll confirm the edit on the free call.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for SPF and DKIM Setup
These are starting points in USD. Your final price depends on your domains, your sending tools, and any subdomain work, and you get a fixed proposal after a free DNS check.
For Agencies
White-Label Email SPF Record and DKIM Work for Agencies
You own the client relationship. We supply the DNS and email authentication work: sender inventories, SPF entries, and DKIM signing, written up under your brand. Your client sees one team, and you hand over records that pass when their IT checks.
How the partnership works
White label: your client only ever sees your brand
Your clientSees only your brand
You, the agencyOwn the relationship
DeveloperLookBehind your brand
Share the domains
Send the client domains and the tools they use, with DNS access or an admin contact.
- Client needs
- You share the details
- Details received
We inventory and write
We list the senders, write the records, and send a change sheet with your branding.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Publish and hand off
Records go live, test results come back, and you hand the sheet to your client.
- Done by our team
- Your brand on it
- Handed to your clientDone
- Your client
- You, the agency
- DeveloperLook
Share the domains
Send the client domains and the tools they use, with DNS access or an admin contact.
- Client needs
- You share the details
- Details received
We inventory and write
We list the senders, write the records, and send a change sheet with your branding.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Publish and hand off
Records go live, test results come back, and you hand the sheet to your client.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
The Right Technology for Your Project
Technology Stack
SPF and DKIM live in DNS and inside each sending tool, so the stack is your DNS host, your mail platform, and the apps that send as you.
- Microsoft 365
- Google Workspace
Amazon SES- Zoho Mail
HubSpot
Salesforce
Zendesk
Shopify- Mailchimp
Cloudflare- Amazon Route 53
- GoDaddy
- Namecheap
Google Cloud DNS
- Message headers
- dig and nslookup
- SPF lookup count
- Gmail Show original
01 / 04
Related Services
SPF and DKIM are the base layer. These services build on it: policy enforcement, bulk sender rules, and the security work around your mailboxes.
Cybersecurity Services
DeveloperLook provides cybersecurity services for businesses without a security team. We assess identity, email, devices, cloud, and web apps, fix the gaps you approve, and recheck every fix, so you get a cybersecurity service provider that does the work.
DMARC Setup Services
DeveloperLook provides DMARC setup services for businesses on Microsoft 365 and Google Workspace. We publish your DMARC record, read the reports to find every real sender, align SPF and DKIM for each one, and step the policy up to reject without blocking real mail.
Email Security Services
DeveloperLook provides email security services for teams on Microsoft 365 and Google Workspace. We tune phishing and malware filters, block risky forwarding, enforce MFA, and give staff a report button. It's business email security set up once, then handed to your IT.This page
SPF and DKIM Setup
Pairs with the 5 services around it
Google and Yahoo Sender Rules Compliance
DeveloperLook provides Google and Yahoo sender rules compliance for email marketing teams. We align SPF, DKIM, and DMARC on every platform you send from, check one-click unsubscribe, and set up Postmaster Tools, so bulk mail meets the Google and Yahoo sender requirements.
Email API Integration Services
DeveloperLook provides email API integration services for product and SaaS teams. We set up SendGrid, Amazon SES, Postmark, or Mailgun, authenticate your sending domains, and wire bounces and complaints back into your app so transactional email arrives.FAQ
Frequently Asked Questions
Straight answers on SPF syntax, DKIM signing, Microsoft 365 and Google Workspace setup, and cost.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
SPF and DKIM setup starts at $350 for one domain with up to 3 sending services. Up to 3 domains and 10 senders, with a subdomain plan for bulk mail, costs $750. Portfolios of up to 10 domains start at $1,250. You get a fixed price after a free DNS check, covering the records, signing in each tool, and inbox tests.
Most single domains are done in 1 to 2 weeks, and portfolios of up to 10 domains take 2 to 3 weeks. Publishing a record takes minutes. The time goes into finding every sender and waiting for each tool's records to resolve, because DNS changes reach receivers only as old cached records expire. We test before calling it done.
An SPF record is a line of text in your domain's DNS that names who may send email as you. It starts with v=spf1, lists your mail services with include: or ip4: entries, and ends with an all rule. A receiving server compares the sending server against that list, then passes, soft-fails, or fails the message.
List every service that sends as your domain, then write one TXT value. It starts with v=spf1, has an include: for each service, and ends with -all or ~all. Microsoft 365 uses include:spf.protection.outlook.com, and Google Workspace uses include:_spf.google.com. Vendor guides that say create SPF record rarely check for an existing one, which is how domains end up with two.
Add it as a TXT record on the root of your domain, shown as @ or a blank host name at most DNS hosts. Paste the full value starting with v=spf1, set a TTL of about an hour, and save. If one already exists, edit that one instead of adding a second, then confirm it resolves with dig or nslookup.
You don't: a domain can publish only one, and two make receivers return a permerror. Merge them instead. Keep one v=spf1 at the start, combine the include: and ip4: entries, and end with a single all rule. If the merged record needs more than 10 DNS lookups, move bulk senders to a subdomain with its own record.
In the Google Admin console, open the Gmail authentication settings, generate a 2048-bit key, and publish the TXT record it shows at your DNS host. Wait for the record to resolve, then start authentication in the same screen. Until you do, Gmail signs with a Google default domain that doesn't match yours, so DMARC can't count that signature.
For Microsoft 365, you publish two CNAME records, selector1 and selector2, then enable DKIM signing for the domain in the Microsoft Defender portal. Other apps follow the same pattern with their own records: HubSpot, Zendesk, or your invoicing tool lists the host names and values. We configure each one, so every app signs as your domain.
Generate it inside the tool that sends the mail, not with a separate key generator. Microsoft 365, Google Workspace, and most apps create the private key themselves and show you the public DKIM record to publish. Choose 2048 bits where it's offered: Gmail's sender guidelines accept 1024-bit keys but recommend 2048.
You get 30 days of support after handover. If you add a new tool in that window, we write its SPF include or signing record and recount the lookups. After that, the record sheet shows your admin where each new record goes, and you can book us again for larger changes such as a new domain.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.