Educational guidance. Email security is not part of the TireTutor product, and TireTutor does not manage your mailboxes. These pages explain how it works so you can brief the right person.
The three records at a glance
Google Workspace values
Copy each value exactly. Replaceexample.com with your own domain.
SPF — TXT record at your domain root (@)
DMARC — TXT record at _dmarc
google._domainkey. Your administrator generates the value in the Google Workspace admin console. Choose a 2048-bit key. After the record goes live, return to the console. Start the authentication there.
Microsoft 365 values
SPF — TXT record at your domain root (@)
DMARC — TXT record at _dmarc
selector1._domainkey and selector2._domainkey. Both values differ for every customer. Your administrator reads them from the Microsoft Defender portal.
Google recommends
~all at the end of the SPF line. Microsoft recommends -all. Use the one your provider publishes, not a mixture.Domains you own but never send from
A shop often owns spare domains: an old business name, a.net twin, a common
misspelling of the real one. Nobody sends mail from them, so nobody protects
them, and a forger can send as any of them.
Publish two records on each spare domain. Together they tell every receiver to
refuse all mail from it. A domain that sends nothing has no mail to break, so it
can start at p=reject rather than working up to it.
SPF — TXT record at the domain root (@)
DMARC — TXT record at _dmarc
Words you may hear
Common mistakes
Free checking tools
Official setup articles
Give these to your IT provider. They hold the current steps for each provider. Google Workspace- Set up SPF
- Set up DKIM
- Set up DMARC
- Troubleshoot DKIM issues — covers reading a message’s headers
Protecting the mailboxes too
These records stop people impersonating your domain. They do nothing about someone getting into a mailbox.- Turn on two-step verification for every mailbox.
- Check your mail rules for forwarding you did not set up.
- Review which apps have access to your mail.
- Give each person their own login instead of one shared account.
- Close accounts the day someone leaves.
- Keep the domain renewal on a card that does not expire.
Where to go next
Checking your setup
Two free checks that show which records you are missing.
Getting the records set up
Find who manages your domain, and what to ask them for.