Which services send email as my firm, and what do they need in my DNS?
Pick the service below.
Last read from the sources at the foot of this page.
Which services give the same records to every customer?
These services print the records in their own documentation. The page for each one shows them exactly.
Which services make records for your account?
These services make the values for your account. The page for each one says where in the account they are shown.
- ActiveCampaign
- Amazon SES
- BoldTrail
- Brevo
- Drip
- Dynamics 365 Customer Insights (Journeys)
- Elastic Email
- Follow Up Boss
- Freshdesk
- Freshsales
- Front
- GetResponse
- HubSpot
- Intercom
- Jira and Jira Service Management (Atlassian)
- Kit
- Klaviyo
- Mailchimp
- Mailchimp Transactional
- MailerLite
- Mailgun
- Mailjet
- Omnisend
- Pipedrive
- Postmark
- Salesforce
- SendGrid
- Shopify
- SMTP2GO
- SparkPost (Bird)
- Squarespace Email Campaigns
- Typeform
- Zoho CRM
Which services send from their own domain?
These services send their email from their own domain, not yours. Your DMARC record does not cover these emails, and p=reject will not break them.
What rules hold for every sender?
SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS. If this limit is exceeded, the implementation MUST return "permerror".
DMARC passes when a message passes SPF or DKIM for your own domain. Read your DMARC reports and check every service before you raise your policy to p=reject.
Keep one SPF record. Add each service inside it, and keep the whole record to at most 10 DNS lookups.
Where does this come from?
- RFC 7208, Sender Policy Frameworkrfc-editor.orgRead 14 October 2026
- RFC 7489, DMARCrfc-editor.orgRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/