Plainwork / Catalogue / Mail Auth Fix Sheet
The exact SPF, DKIM and DMARC records for your domain
Tell us your domain and the services that send as it. Within 24 hours you get a fix sheet from your live DNS and each vendor's own setup page, with the records to publish and a safe order.
- Your live DNS read over DNS-over-HTTPS: SPF tree with the lookup count, DMARC, MX and DKIM keys, with the raw lines as evidence
- Each sender you name checked against that vendor's own current setup page, with the required record quoted, linked and dated
- The exact records to add, replace or delete, old value next to new, ready to paste at your DNS host
- Your SPF lookup budget before and after, with the exact record text counted by the open-source checker (not by hand), alternatives included
- A dated DMARC rollout from p=none to reject, with a go/no-go check and a rollback line at every step
- Google, Yahoo and Microsoft sender rules quoted for your volume, and honest notes where yours is below their threshold
- An UNKNOWN list: anything DNS cannot show is stated, never guessed
- Delivered on your order page and by email within 24 hours
Sample brief: plainworkdigital.com, which sends order emails through Resend and forwards inbound mail with Cloudflare Email Routing, under 100 messages a day. DNS read 2026-10-15 over Cloudflare DNS-over-HTTPS. Read the full sample, which also holds a second, messier example on a constructed domain (shop.example) with two SPF records, DELETE and REPLACE lines and a budget that changes.
The answer first. (1) Publish one new record, DMARC at p=none with a report address: it is the only thing missing, and SPF and DKIM for both senders are already in place. (2) Leave SPF alone: the root record uses 1 of 10 lookups, and Resend sends from the send subdomain so it needs no include at the root. (3) Do not enforce yet: mail forwarded through Cloudflare cannot be judged from DNS, so wait for two weeks of reports.
The record to publish: _dmarc TXT v=DMARC1; p=none; rua=mailto:[email protected];, with the report address marked ASSUMED because the sheet cannot know your mailbox. The rollout: publish 2026-10-15, read reports 2026-10-29, quarantine at 10%, 50%, then 100% a week apart, reject no earlier than 2026-11-26, each step gated on seven clean days. Evidence: every DNS line and every vendor quotation in the sample is re-checked by a script.
Made for
Who it's for
No logins, no DNS access
We read public DNS and public vendor pages only. You apply the records yourself, so nobody holds your keys.
A decision, not a diagnosis
Free checkers list problems. The sheet says which sender to remove or move, and gives the final record text.
Rules from the source
Each vendor requirement is quoted from its own page with the fetch date, not recalled from memory.
Safe order of changes
A dated rollout with a check at every step, so enforcing DMARC does not block a sender you forgot.
How it works
From checkout to done
Buy
Pay and fill in the short brief: domain, senders, problem, volume
Open
We read your live DNS and each vendor's setup page and test them against your brief
Use
Get the fix sheet on your order page and by email within 24 hours
Questions
Good to know
Do you need my DNS or email login?
No, and the form never asks. We read public DNS and public vendor pages. You publish the records yourself.
Will this fix my spam-folder problem?
We promise no inbox placement. Authentication is one cause among several (reputation, content, blocklists); the sheet fixes authentication and says plainly what DNS cannot show.
What if you cannot find my DKIM selector?
We probe 24 common selector names and read each named vendor's docs. If a selector cannot be established it is marked UNKNOWN, with where in your sender's dashboard to find it.
Is it written by a person?
It is AI-written from public sources fetched on the delivery date, with each rule quoted and dated. It is not legal or compliance advice.
Can I just use a free checker?
If you only need a diagnosis, yes: our own checker is free. The sheet is for people who want the final records, the lookup budget and the rollout written for their senders.
What if it doesn't work for me?
If it doesn't work as described or you can't access it, email us within 14 days and we'll fix it or refund you. See the refund policy for details.
Mail Auth Fix Sheet
Your domain's SPF, DKIM and DMARC read from live DNS, with copy-paste records, your SPF lookup count and a dated rollout, in 24 hours.
More from the catalogue
Other small tools
Polyglot for Ghost
Multilingual Ghost on one install: routes, hreflang, language switcher, menus and strings, a patched Source theme and a CLI. One-time $29.
Skill Ledger
SKILL.md library with spec checks, listing budget and trigger tests. Free for 12 skills; $5/month syncs 150.
Vantage
Free daily skyscrapers-style logic puzzle: one answer per board, no ads, no account. Supporter Pass $4.