Help
Setup & support
First run · sending domain · data files · backups
Everything here is for someone who already has Grezzio running and hit something. If you are still deciding whether to buy it, the overview is the page you want.
Check your sending domain
This is the one setting that decides whether your mail arrives or disappears, and it lives outside Grezzio, in your domain's DNS. You do not need to understand the three acronyms below. Type your domain and this page will tell you what is missing and exactly what to paste.
Nothing is sent to us. Your browser asks a public DNS resolver directly, the same way any mail server would.
What the three records actually do
In one sentence each, without the jargon:
- SPF is the list of servers allowed to send mail in your name. Without it, anything that is not signed gets treated as suspicious.
- DKIM is a signature your mail server puts on every message. It survives forwarding, which is why it matters more than SPF.
- DMARC tells receiving servers what to do when the other two fail, and can send you a report so you find out.
A DMARC policy of p=reject with no SPF record. Your domain is telling every receiving server to reject whatever it cannot verify, while giving it only one way to verify. Anything sent through a path that does not sign your messages is discarded, and without a reporting address you never find out.
Find your provider and copy one line
Two different companies can be involved, and you may need a line for each. The mailbox host is where your mail lives and where you read it. A sending relay is a service that sends bulk mail on your behalf. If you use both, list both in the same record.
Mailbox hosts14
Where your mail lives. Everyone needs exactly one line from this table.
| Provider | Put this in SPF | DKIM |
|---|---|---|
| Google Workspace The leading underscore in include:_spf.google.com is required and correct - the lookalike spf.google.com (no underscore) does not exist at all, so that typo makes the whole SPF record unresolvable rather than just wrong. Also note DKIM is not on until you click Start authentication in the Admin console, so the TXT record alone does nothing. | _spf.google.com | one TXT record |
| Microsoft 365 / Outlook for business The Microsoft 365 include has no leading underscore, no trailing dot, and is not the near-identical government or China variant: spf.protection.office365.us (GCC High/DoD) and spf.protection.partner.outlook.cn (21Vianet) look almost right but break a normal tenant. Microsoft's own recommendation is -all rather than ~all, and the DKIM CNAME targets are unique per tenant in a newer ...-v1.dkim.mail.microsoft format, so always copy them from the portal instead of guessing the old onmicrosoft.com-style value. | spf.protection.outlook.com | CNAME records |
| Zoho Mail The correct include is the plain domain zoho.com, with no prefix. Beware of _spf.zoho.com: it looks right (people copy the pattern from Google's _spf.google.com) and it does resolve to a real record, so nothing appears broken, but it lists only part of Zoho's sending servers and quietly fails mail sent through the rest. spf.zoho.com has the same problem. If you use several Zoho products beyond Mail, Zoho instead documents include:one.zoho.com. | zoho.com | one TXT record |
| Fastmail Use spf.messagingengine.com only. The lookalikes spf.fastmail.com and _spf.fastmail.com do return a valid-looking SPF answer, but only because fastmail.com has a catch-all TXT record that answers for any name, so they are undocumented and can stop working without warning; _spf.messagingengine.com does not exist at all and will break your SPF. Also note the DKIM CNAME target must contain your own domain in the middle (fm1.yourdomain.com.dkim.fmhosted.com), and that spf.messagingengine.com itself ends in -all, which is normal and must not be edited. | spf.messagingengine.com | CNAME records |
| Proton Mail (custom domain) UNVERIFIED: rate limiting blocked all access to Proton's official docs during this check, so these values come from prior knowledge and must be confirmed against proton.me/support before publishing. Two things to double-check: the leading underscore in _spf.protonmail.ch (a similarly named host without the underscore is reported to exist and behave differently), and the exact CNAME targets, which are unique per domain and must be copied from your own Proton DKIM screen rather than from any example. | _spf.protonmail.ch | CNAME records |
| Strato (DE/NL hosting) Only _spf.strato.com exists - _spf.strato.de and spf.strato.com are not real hostnames and silently break the record, which is an easy mistake to make because Strato is otherwise a .de brand. Strato's own help page shows "v=spf1 redirect=_spf.strato.com", but redirect ends the record and cannot be combined with any other sender, so use the include: version above if anything besides Strato sends your mail. | _spf.strato.com | handled for you |
| IONOS / 1&1 IONOS has two includes that are NOT interchangeable: _spf-us.ionos.com for US accounts and _spf-eu.ionos.com for UK/EU accounts, so check which IONOS market the mailbox was bought in before copying. Also beware the old 1&1 names _spf.perfora.net and _spf.kundenserver.de, which still resolve with almost the same IP list but end in -all, and note that the s42582890._domainkey record printed in IONOS's own DKIM help table is one customer's example that does not resolve for anyone else. | _spf-us.ionos.com | CNAME records |
| OVHcloud mail Use mx.ovh.com only: mx.ovh.net is a genuine OVHcloud mail hostname but publishes no SPF record at all, so include:mx.ovh.net silently breaks your whole record. No underscore-prefixed decoy exists for OVH, but mx.ovh.com's own record ends in ?all (neutral), so DKIM matters more here than with most providers. | mx.ovh.com | CNAME records |
| TransIP (NL) Watch the underscore: the correct include is _spf.transip.email, while plain transip.email publishes "v=spf1 -all" and would make every message from your domain fail SPF. _spf.transip.nl is also wrong for customers: it is TransIP's own corporate record, ends in -all, and lists only their in-house servers. Use only one SPF record per domain, and if a TransIP mail service already added records, edit the existing one instead of adding a second. | _spf.transip.email | TXT and CNAME |
| Infomaniak Watch the country ending: the correct host is spf.infomaniak.ch with .ch, even though the company website is infomaniak.com. The lookalike spf.infomaniak.com does exist and returns a real-looking SPF record, but it is Infomaniak's own company record and will not authorise your mailboxes. The underscore versions (_spf.infomaniak.ch and _spf.infomaniak.com) do not exist at all and will break your SPF check. Infomaniak's own guide suggests ending with -all rather than the ~all used here. | _spf.infomaniak.ch | one TXT record |
| Hostinger email Mind the leading underscore: the lookalike spf.mail.hostinger.com (no underscore) does exist in Hostinger's DNS but holds no SPF data, so an include pointing at it makes the entire SPF record fail instead of just being ignored. Also keep only one SPF TXT record on the domain - a second one breaks both. | _spf.mail.hostinger.com | CNAME records |
| GoDaddy / Microsoft 365 from GoDaddy There is no such host as _spf.secureserver.net — that name does not exist in DNS at all (people type it out of habit from Google's _spf.google.com), and using it breaks SPF completely, so the value must have no underscore and no prefix. You also do not need to add spf.protection.outlook.com separately: include:secureserver.net already chains through to Microsoft's mail servers. | secureserver.net | CNAME records |
| Namecheap Private Email (Jellyfish) Do not use _spf.privateemail.com with a leading underscore: that hostname does not exist, so the record fails SPF checks instead of passing them. Also avoid spf.web-hosting.com, which looks similar but belongs to Namecheap's cPanel hosting mail, not Private Email. | spf.privateemail.com | one TXT record |
| Yandex 360 for business Watch the leading underscore: the correct name is _spf.yandex.net. The version without it, spf.yandex.net, does not exist at all, so a typo silently breaks SPF instead of showing an error. Yandex's own default suggestion is "v=spf1 redirect=_spf.yandex.net" with no ~all — that works too, but only if it is your domain's single SPF record; if you also send through anything else, use the include form above instead. If you delegate your domain to Yandex's own DNS servers, Yandex creates the MX, SPF and DKIM records for you and you should not add them by hand. | _spf.yandex.net | one TXT record |
Sending relays8
Services that send bulk mail for you. Add a line from this table as well as the one above, and only if you actually use one.
| Service | Put this in SPF | DKIM |
|---|---|---|
| Brevo (formerly Sendinblue) Mind the underscore: _spf.brevo.com is a real hostname that publishes "v=spf1 -all", so a typo there would reject all your mail - the correct value is spf.brevo.com with no underscore. Also note Brevo does not require SPF to authenticate a domain (it asks only for the Brevo code, DKIM and DMARC) and only hands out an SPF record with a dedicated IP or branded subdomain. | spf.brevo.com | TXT and CNAME |
| Twilio SendGrid Watch the ending: include:sendgrid.com (.com) resolves and passes a syntax check but is Twilio's own corporate record and does NOT authorise your mail - it must be sendgrid.net. There is no _spf.sendgrid.net or spf.sendgrid.net; those names do not exist and would break the whole SPF record. | sendgrid.net | TXT and CNAME |
| Mailgun Use mailgun.org, never mailgun.com — the .com is Mailgun's own corporate domain and its SPF points at Outlook, Pardot and Zendesk. Also do not shorten it to include:_spf.mailgun.org: that underscore hostname is real and resolves, but it covers only the US region and silently drops Mailgun's EU sending IPs. | mailgun.org | TXT and CNAME |
| Amazon SES There is no "_spf.amazonses.com" — the only valid include is "amazonses.com"; a TXT record at _amazonses.yourdomain.com is SES's separate ownership-verification token, not SPF. Two real traps: AWS only asks for this SPF record on the custom MAIL FROM subdomain (e.g. mail.yourdomain.com, which also needs one MX record "10 feedback-smtp.<region>.amazonses.com"), and you must never add an extra leading underscore to the DKIM CNAME names — abc123._domainkey.yourdomain.com is correct, _abc123._domainkey.yourdomain.com is not. | amazonses.com | TXT and CNAME |
| Postmark Postmark no longer requires SPF at all, and adding include:spf.mtasv.net to your own domain does not fix DMARC alignment on its own; the record that does is the pm-bounces CNAME pointing to pm.mtasv.net, so do not treat the SPF include as a substitute for it. Watch the two similar-looking hostnames: spf.mtasv.net is the include value, while pm.mtasv.net is only ever a CNAME target and must not be put in an include. | spf.mtasv.net | one TXT record |
| Mailchimp Transactional / Mandrill Do not use servers.mcsv.net here: that is the SPF host for regular Mailchimp marketing campaigns and it ends in -all, so it looks correct but does not authorise Mandrill sending. Also note there is no _spf.mandrillapp.com (the underscore version does not exist at all, and including it makes the whole SPF record fail), and because Mandrill's default return-path is mandrillapp.com, SPF only aligns for DMARC if you also set up a custom Return Path domain under Settings, Tracking and Return Path Domains. | spf.mandrillapp.com | CNAME records |
| MailerSend Watch the .net/.com trap: _spf.mailersend.com is a real record but it is MailerSend's own company SPF, ending in -all with five nested includes - using it will not authorise your mail and eats your 10-lookup limit, so the include must be _spf.mailersend.net. Also, both DKIM records (ms1 and ms2) must be added: MailerSend recently moved from one 1024-bit key to two 2048-bit keys, and a domain with only one of them will never finish verifying. | _spf.mailersend.net | CNAME records |
| SMTP2GO In the normal setup SMTP2GO wants NO SPF include - the "em..." CNAME covers SPF via VERP, and include:spf.smtp2go.com is only needed if you switch on Settings > Sending Options > Advanced > Maintain Return-Path. Watch the leading underscore: _spf.smtp2go.com is only a CNAME to the SMTP2GO website and publishes no SPF record, so including it gives you an SPF permerror rather than a pass. | spf.smtp2go.com | CNAME records |
One domain gets exactly one SPF record. Never two: a second one voids both. To allow a host and a relay, put both includes in the same line, in any order, and keep a single ending:
v=spf1 include:HOST include:RELAY ~all
Keep the total number of include: entries at four or fewer. Each one costs DNS lookups and the hard limit is ten for the whole record.
If you cannot change any of this
There is one situation where none of the above applies, and it is common enough to name plainly.
If your address ends in @gmail.com, @outlook.com, @wp.pl or any other address on somebody else's domain, you cannot set these records. You do not own that domain, so there is nothing to configure.
That is not a limitation to work around. Cold outreach from a free mailbox performs badly regardless of configuration, and providers rate-limit it aggressively. Register a domain, point it at any of the hosts in the table above, and send from that. It costs about ten euro a year and it is the single largest improvement available to a new sender.
The same applies to a domain someone else administers. You do not need access to the mail server, only to the DNS records of the domain, which is usually where you bought it. If a colleague or an agency holds that, send them the line this page produced; it is one record and takes them a minute.
Start soft, then tighten
Every record this page suggests ends in ~all, a soft fail, rather than -all. That is deliberate. A soft fail leaves room for a sending path you forgot about, such as an old form on your website or an invoicing tool. Add a DMARC reporting address, wait two weeks, see what shows up, and only then tighten to -all.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.tld;
Start at p=none if you have no DMARC record at all. It changes nothing about delivery and only turns on the reports. Move to p=quarantine and then p=reject once the reports are clean. Going straight to reject before SPF and DKIM are both in place is how mail disappears.
DNS changes usually take effect within about fifteen minutes. Run the check at the top of this page again afterwards.
Two mailboxes on one domain
Grezzio warns about this when you add the second one, and the warning is not bureaucracy. Reputation is measured per domain, not per address. Two mailboxes on one domain are one reputation carrying twice the load, and if the domain is blocklisted both stop at the same moment. Running campaigns in parallel needs a second domain, not a second mailbox.
First run
Install it and open it. There is nothing to set up first, no account to create and nothing else to download. The installer puts the program, the 329,266-place index and the licence texts where they belong, and the program builds its own database the first time it starts.
- Open it from the Start menu, under Grezzio. If you ticked the desktop icon during installation, it is there too.
- It opens in its own window, maximised, with no browser address bar and no black console window. It should look like an ordinary program, because that is what it is.
- If you close the window by accident, open Grezzio from the Start menu again. Do not use a browser bookmark: the program gives itself a fresh access key every time it starts, so yesterday's address is dead by design.
- Nothing is sent anywhere on first run. The place index already works offline, so you can search for companies before you have configured a mailbox at all.
Where your things end up
You do not need this to use the program. It is here for the day you want to copy your data to another machine, or hand it to someone for support.
| What | Where |
|---|---|
| The program, the place index, the licence texts | C:\Program Files\Grezzio |
| Your database, backups, and the shortcut that reopens the window | %APPDATA%\Grezzio |
The two are separate on purpose. Windows does not let a program write into its own folder in Program Files, and keeping your data outside it means an update or a reinstall cannot touch your lists. Uninstalling Grezzio leaves the database alone. The About screen inside the program shows both paths and copies them to the clipboard in one click.
Some copies are delivered as a folder rather than an installer, for example when Grezzio runs from a shared drive. Then everything, database included, stays in that one folder, you start it with the Uruchom_Grezzio file inside it, and a console window stays open behind the program. Closing that console stops Grezzio.
When finding businesses stops working
- "Missing the DuckDB component". The search tab needs one extra component. Install it with pip install duckdb, or use a build of the program that bundles it.
- The first search on a machine is slow. DuckDB downloads two of its own extensions the first time, about fifteen megabytes, once. Without a connection that first search fails and the program says so plainly.
- The data provider changed its layout. That is what the file at grezzio.nl/overture.json is for. Point the program at it in Settings, under the data source description, and a change on their side becomes a file swap here rather than a new version for everyone.
The place index
The program ships with an index of 329,266 regions, counties, municipalities and localities across all 53 markets, so the place field answers instantly and offline. It also checks this site once a day for a newer one, compares the release number and only then downloads. The download is verified against a checksum and inspected before it is allowed to replace a working file.
| File | Purpose | Size |
|---|---|---|
| overture.json | Trades and data paths. Fixes a provider change without a new release. | 3 kB |
| place-index.json | Description of the current place index: release, size, checksum. | 0.3 kB |
| place-index.db.gz | The place index itself. Fetched only when the release differs. | 18.7 MB |
Backups and the database
- Seven daily copies are kept, written through SQLite's own API rather than copied as a file, so a backup can never catch the database mid-write.
- A copy is always taken before a format change and before a restore.
- A database from a newer version refuses to open rather than being silently damaged by an older one.
- Moving to another computer: copy the whole folder. Saved passwords will not travel, because they are encrypted to your Windows account by design. Enter them again on the new machine.
Still stuck
Write to support@grezzio.nl. Open the About screen first and use its copy button: it puts the version, rule-set age, database format, paths and counters on your clipboard, which answers the first four questions before they are asked. For invoicing and licence questions, info@logosphere.nl reaches the same people.