Design perfect DNS, SPF, DKIM & Reverse DNS records
Inspect any existing domain live via UDP DNS or generate a complete, copy-ready DNS zone with RFC 7208 SPF lookup counting, Dual-DKIM, DMARC, MTA-STS, and exact IPv4 in-addr.arpa plus 32-nibble IPv6 ip6.arpa PTR records.
Domain, IP & Policy Configuration
Generates complete DNS and reverse DNS records with live inspection
What Gmail, Microsoft 365, and enterprise gateways verify
1. Forward-Confirmed Reverse DNS (FCrDNS)
Both your public IPv4 and IPv6 addresses must have PTR records at your hoster pointing to the exact EHLO hostname (e.g. mail.company.com).
2. Striktes SPF unter 10 Lookups
Use direct ip4: and ip6: mechanisms (0 extra DNS queries) for your own server and finish with strict -all enforcement.
3. Dual-DKIM & DMARC Alignment
Sign every outbound message with Ed25519 + RSA-2048 in SharpMailserver and publish DMARC p=quarantine or p=reject with RUA reporting.
Frequently Asked DNS & Deliverability Questions
Why is Reverse DNS (PTR) and FCrDNS mandatory for mail delivery?
Major receivers like Gmail, Microsoft 365, and corporate gateways verify that both your IPv4 and IPv6 sending addresses resolve via PTR to your EHLO hostname, and that this hostname resolves back to the exact same IP (Forward-Confirmed Reverse DNS). Without FCrDNS, outbound messages are rejected or routed to junk.
What is the RFC 7208 10-DNS-lookup limit in SPF?
SPF evaluation aborts with a PermError if mechanisms such as mx, a, include, and redirect trigger more than 10 total DNS queries. Our advisor calculates your lookup budget in real time and recommends direct ip4/ip6 mechanisms where possible.
Why use Dual-DKIM with both Ed25519 and RSA-2048?
Ed25519 (RFC 8463) provides ultra-compact elliptic-curve DNS records and high cryptographic strength, while RSA-2048 ensures universal compatibility with legacy gateways. SharpMailserver signs every message with both signatures simultaneously.