DMARC, SPF and DKIM Record Generator

Anyone can type any address into the From line of an e-mail, which is why forged messages are so common. Three DNS records let a domain owner fight that. SPF lists the servers allowed to send mail for the domain. DKIM adds a signature that receivers verify with a public key you publish. DMARC ties the two together, tells receivers what to do when a message fails both and where to send reports. This page builds all three, with the details that cause most mistakes handled for you.

SPF

An SPF record is a TXT record that starts v=spf1, followed by mechanisms and an ending. Pick the services that send mail for you from the list and the page adds their include: terms. Add your own servers as ip4: and ip6: ranges, and tick a or mx to allow the servers at the domain’s address or mail records. The ending ~all marks everything else as a soft fail, -all as a hard fail and ?all as neutral, which gives no protection. The sample produces v=spf1 ip4:203.0.113.5 include:_spf.google.com include:sendgrid.net ~all for example.com.

The 10-lookup limit

RFC 7208 allows at most ten DNS lookups while evaluating an SPF record. Each include, a, mx and redirect costs one, and the included records add their own. Go over the limit and the check ends in a permanent error, which most receivers treat as a failure, so a long list of marketing tools can silently break your mail. The page tells you how many lookups your own terms use. Big providers add more behind the scenes, so confirm the real total with the SPF Record Checker after publishing.

DMARC

A DMARC record lives at _dmarc.yourdomain. Its policy p says what to do with failing mail: none only reports, quarantine asks receivers to treat it as suspicious, reject asks them to refuse it. sp sets a different policy for subdomains, pct applies the policy to a percentage of failing mail, and adkim and aspf choose relaxed or strict alignment. The rua address receives daily aggregate reports. The safe route is to publish p=none with a rua address, read the reports for a few weeks to find every legitimate sender, fix SPF and DKIM for them, and only then tighten to quarantine and reject, raising pct in steps.

DKIM

You generate a key pair on the system that signs your mail, or use the one your provider gives you, and publish the public key. Choose a selector, a label such as mail2026, paste the public key in PEM or Base64, and the page writes the record name mail2026._domainkey.example.com and the value v=DKIM1; k=rsa; p=…. Long values must be split into strings of at most 255 characters in a zone file, and the page provides the split line. A warning appears for RSA keys shorter than 2048 bits. Never paste a private key.

Limits

The page builds the text only; it cannot publish it, check that it resolves or test your mail flow. SPF lookups inside included services are not counted. Records for several mail providers need testing with real messages and with the checkers.

Related tools

• SPF Record Checker tests a published SPF record and counts real lookups.
• DMARC Checker reads a published DMARC policy.
• DKIM Record Checker finds and validates a selector’s key.
• Email Header Analyzer shows the results of these checks on a real message.