SPF/DKIM/DMARC Generator

Generate secure, syntactically correct DNS records to authorize your mail servers and secure your domain.

SPF/DKIM/DMARC Generator

Generate copy-paste ready DNS records for SPF, DKIM, and DMARC email authentication.

SPF Settings

What is SPF & why it matters

SPF (Sender Policy Framework) is a DNS record listing which servers are allowed to send email for your domain. When a receiver gets a message claiming to be from you, it checks the sending server against this list — anything not authorized can be flagged or rejected. It's your first line of defense against spammers forging your address.

Tick the sources you actually send from — your own servers (mx/a) plus any providers like Google or Resend — then choose how strictly receivers should treat unlisted senders with the all setting below.

Advanced: SPF macros

Macros are placeholders that SPF expands at the moment mail arrives, using facts about the incoming message. They let one fixed record make dynamic, per-message decisions — most often paired with the exists mechanism to look up a per-sender or per-IP name in DNS.

They're written as %{letter}. The common ones:

%{s} full sender user@domain · %{l} local part · %{o} sender's domain
%{d} the domain being checked (yours)
%{i} the sending server's IP · %{h} its HELO/EHLO name · %{p} its PTR name (discouraged)

A trailing r reverses the parts (%{ir} = IP written backwards), and a digit keeps only the right-most N labels (%{d2} = last two labels of the domain).

Example

v=spf1 exists:%{ir}.%{d}._spf.example.com -all

For each connection SPF reverses the sender's IP and checks whether <reversed-ip>.example.com._spf.example.com exists in DNS — if it does, the mail passes. That's how big senders manage massive, constantly-changing allow-lists entirely in DNS instead of cramming IPs into the record.

Rarely needed for a normal domain. Macros are hard to debug, still count toward SPF's 10-DNS-lookup limit, and %{p}/PTR tricks are unreliable. This wizard sticks to the plain mechanisms above — but now you'll recognize macros when you meet them in someone else's record.

Domain Name

Just for your reference — an SPF record's content is the same regardless of domain, and it's always published at the root (host @).

Authorize MX Servers

Allow servers in MX records to send mail

Authorize A IP Addresses

Allow your domain's primary A/AAAA IPs

IPv4 Addresses (Space separated)

IPv6 Addresses (Space separated)

Common Email Services

Google Workspace Microsoft 365 Resend SendGrid Mailgun Postmark

Additional Include Domains (Space separated)

Strictness Policy (All Modifier)

Soft Fail (~all) Recommended. Accepts mail but flags failures. Hard Fail (-all) Strict. Instructs receivers to reject unauthorized mail. Neutral (?all) No policy. Testing mode. Accepts all mail.

Add a subdomain lockdown record (wildcard)

Publishes a second record on host * that rejects mail from any subdomain you don't send from — a common anti-spoofing step. Appears as an extra record on the right.

DKIM Parameters

What is DKIM & why it matters

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. Your mail server signs outgoing mail with a private key; you publish the matching public key in DNS. Receivers verify the signature to prove the message really came from you and wasn't tampered with in transit.

You need three things: a selector (a label, so a domain can hold several keys), a key pair, and this TXT record. Generate a pair below, install the private key on your mail server, and publish the public key here.

DKIM Selector

A label you choose so a domain can hold several DKIM keys at once (per-provider, or for key rotation). Your provider often dictates it — e.g. google, k1, s1. It becomes part of the record's host name.

Key Type

RSA works everywhere. Ed25519 keys are tiny and fast but not every receiver validates them yet — publish it alongside an RSA key if you use it.

RSA Key Size

2048-bit is the modern standard. A few older DNS panels reject the longer record, in which case 1024-bit is the fallback.

Generate a key pair

Runs entirely in your browser (Web Crypto) — the private key never leaves this page or touches our server.

Public Key (Base64) — safe to publish in DNS

The public half of the pair. Paste one from your provider, or click Generate above to fill it automatically.

Private Key (PKCS#8 PEM) — keep secret

Install this on your mail server (OpenDKIM, your ESP, etc.). Never put it in DNS, email it, or commit it to a repo. It isn't stored anywhere — copy it now, because it's gone once you leave this page.

DMARC Policy

What is DMARC & why it matters

DMARC ties SPF and DKIM together and tells receivers what to do when a message fails both checks — nothing, quarantine (spam folder), or reject. It also emails you reports on who's sending mail as your domain, so you can spot abuse and misconfigured services.

Roll it out gradually: start at p=none with a reports address to watch traffic safely, then tighten to quarantine and finally reject once you've confirmed all your legitimate mail passes.

Domain Name

Receiver Policy (p=)

None (p=none) Monitoring only. No delivery interference. Recommended to start. Quarantine Send failed emails to the spam/junk folder. Reject (p=reject) Strict. Block failed emails from being delivered at all.

Subdomain Policy (sp=) (Optional)

Aggregate Reports Email (RUA)

Forensic Failure Email (RUF)

RUA = daily aggregate summaries (start here — this is how you see what's sending as you). RUF = per-message failure copies; many providers don't send them and they can contain recipient data, so it's optional. A dedicated inbox is wise — reports add up fast.

SPF Alignment

DKIM Alignment

Alignment decides how closely the SPF/DKIM domain must match your From: address. Relaxed (default) accepts subdomains and is right for almost everyone; Strict demands an exact match and often breaks mail sent through third-party services.

Policy Apply Percentage: 100%

Generated Record

TXT

DNS TXT Host/Name

TXT Value

v=spf1 mx a ~all

Copied to clipboard!

Wildcard Subdomain Record

optional · host *

v=spf1 -all

SPF only protects the exact domain it's published on, so your root record does nothing for subdomains. Add a TXT record at host * with this value and it becomes the default SPF for invented subdomains like promo.yourdomain.com — telling receivers to reject mail from them. Caveats: a DNS wildcard only answers for a subdomain that has no records of any type (give ones that do their own SPF), it doesn't cover your root domain, and DMARC's sp=reject is the cleaner, stronger subdomain control.

DNS Deployment Steps:

Log in to your domain registrar (e.g. Cloudflare, Namecheap, GoDaddy).
Navigate to your domain's **DNS Management** page.
Add a new record of type TXT.
Paste the **Host/Name** and **TXT Value** exactly as shown above.
Set the TTL to **Auto** (or **3600** seconds) and save.

About this tool

This wizard helps you construct SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) records. Answering a few simple questions generates the exact TXT records you need to add to your domain's DNS zone.

Using correct email authentication records is critical: it authorizes valid mail servers (like Google Workspace, Microsoft 365, or transactional services like Resend) to send mail on your behalf, reducing the risk of your emails landing in spam or being spoofed by bad actors.