Skip to main content
iotools.cloudiotools.cloud

SPF / DKIM / DMARC Record Generator

Generate SPF, DKIM and DMARC DNS TXT records for your domain — pick email providers for SPF, count DNS lookups against the RFC 7208 limit, build a DKIM record from a public key, and set a DMARC rollout policy.

Input

Setup

Used to build record names (e.g. selector._domainkey.example.com, _dmarc.example.com). Leave blank for a generic example.

Time-to-live in seconds. 3600 (1h) is typical; raise after records stabilize.

SPF Record

Optional. One IP or CIDR per line. Adds ip4: mechanisms (no DNS lookup cost).

Optional. One IP or CIDR per line. Adds ip6: mechanisms.

Optional. One domain per line. Each adds include:<domain> (1 DNS lookup each).

DKIM Record

Used by your mail server. Common values: default, google, mail, s1, dkim. Must match your signer's config.

Paste the base64 public key portion. Headers/footers, newlines, and whitespace are stripped automatically.

DMARC Record

sp= tag. Leave on Inherit to omit sp= (DMARC defaults to main policy).

% of failing messages to apply the policy to. Ramp from 10 → 100 when enforcing.

Mailbox for daily XML aggregate reports. Prefix with mailto: not required — added automatically.

Optional. Mailbox for per-message failure reports. Few providers send these.

adkim= tag. Relaxed allows subdomains to match; strict requires exact match.

aspf= tag. Relaxed allows subdomains to match; strict requires exact match.

Output

SPF Record
DKIM Record
DMARC Record
Was this helpful?

Guides

What are SPF, DKIM, and DMARC?

These three DNS TXT records work together to prevent your domain from being spoofed in phishing and spam emails:

  • SPF (Sender Policy Framework) lists which mail servers are allowed to send email for your domain.
  • DKIM (DomainKeys Identified Mail) lets receiving servers cryptographically verify that a message wasn't altered in transit and really came from your domain.
  • DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receivers what to do when SPF or DKIM fail, and where to send reports about those failures.

How this tool works

  1. Enter your domain (optional — leave blank for a generic example) and a TTL.
  2. For SPF, check off the email services your domain sends through (Google Workspace, Microsoft 365, SendGrid, and others), optionally authorize your domain's own A/MX records, add raw IPv4/IPv6 ranges or custom includes, and pick an all mechanism (~all softfail is the safe default while rolling out; -all hardfail once you're confident every sender is listed).
  3. For DKIM, set a selector and paste your mail server's base64 public key — PEM headers and whitespace are stripped automatically.
  4. For DMARC, choose a policy (none to just monitor, quarantine to send failures to spam, reject to block them outright), a percentage to enforce it on, and an aggregate report mailbox.

Each record shows its exact Name, Type, TTL, and Value, plus contextual details: SPF counts DNS lookups against the RFC 7208 10-lookup limit and flags mechanisms that would blow past it, DKIM reports key length, and DMARC shows a recommended staged rollout.

Why the 10-lookup SPF limit matters

Every include:, bare a, bare mx, ptr, exists: and redirect= mechanism costs one DNS lookup when a receiving server evaluates your SPF record — ip4:/ip6:/all are free. RFC 7208 caps this at 10; exceeding it causes a PermError, and many receivers then treat your SPF as if it didn't exist, undermining the very protection you set it up for.

DMARC's recommended rollout

Jumping straight to p=reject risks blocking legitimate mail from services you forgot were sending on your behalf. The safer path: start at p=none with an aggregate report address to see what SPF/DKIM failures actually look like, then ramp p=quarantine at 10% and increase gradually, before finally moving to p=reject at 100%.

Common uses

  • Setting up email authentication for a new domain before sending your first campaign
  • Auditing whether an SPF record is close to the 10-lookup limit
  • Building a DKIM TXT record from a key generated by your mail provider
  • Planning a safe, staged DMARC enforcement rollout

Privacy

This tool runs entirely in your browser. Your domain and keys are never uploaded to a server.

spfdkimdmarcdnsemail authenticationtxt record

Love the tools? Lose the ads.

One payment clears every ad from your account, for good. No subscription, no tracking.

Remove ads