Email security tools

Free DMARC & SPF Record Generator

Build email authentication records for your domain. Choose your legitimate senders, start with a monitoring policy, and get clear DNS setup instructions.

  • Generated in your browser
  • No API key required
  • Optional live DNS check

1. Domain and sending services

Use the domain you are configuring. For SPF, this should be your envelope sender / Return-Path domain; for DMARC, the visible From domain. If these differ, generate the appropriate record separately for each domain.

Services that send email for this domain

2. DMARC policy and reporting

Advanced alignment settings

Relaxed alignment is the default. Strict alignment requires an exact domain match and can cause legitimate mail to fail DMARC.

Generation stays in this page and does not publish DNS changes. Form contents are not saved by this tool.

From records to publication

Publish and verify your email authentication

  1. Inventory every legitimate sender, including your mailbox provider, website, support desk and marketing service. Use each provider’s current SPF and DKIM instructions.
  2. Check existing DNS first. Merge sending sources into one SPF record at the correct envelope sender domain. Update the existing DMARC record rather than adding a second one.
  3. Configure DKIM signing with your email providers. Start DMARC with p=none and a reporting mailbox you control.
  4. Publish the TXT values in your DNS dashboard. DNS providers differ in how they accept host names and long TXT strings.
  5. Recheck DNS after propagation, send real messages from every service, and review authentication headers and aggregate reports before enforcing quarantine or rejection.

Direct DNS checks do not certify your configuration, delivery, or spoofing protection. No DNS changes are made by this tool.

Common questions

Frequently asked questions

What is the difference between SPF, DKIM and DMARC?

SPF authorizes sending IP addresses for the envelope sender domain. DKIM signs messages using keys configured by your email provider. DMARC checks whether a passing SPF or DKIM identity aligns with the visible From domain and requests handling and reports. This generator creates SPF and DMARC records; configure DKIM separately with each provider.

Can I publish more than one SPF record?

No. Publish one v=spf1 TXT record at each sending domain. Combine legitimate sending services in that record. Other unrelated TXT records can coexist. Publish one DMARC policy record at the applicable _dmarc name.

Should I start with none, quarantine or reject?

Start with p=none to monitor, using an aggregate reporting address you control. Review reports across your normal sending cycles and fix alignment problems before moving to quarantine or reject. Monitoring does not request blocking, and reports are sent at the receiving provider’s discretion.

Does the generator check the full SPF lookup limit?

No. It counts direct include terms in the generated record and prevents more than ten. Provider records can introduce nested includes and other lookup terms. The optional DNS check reads the two exact TXT names, not the recursive SPF evaluation path, organizational-domain DMARC inheritance, or message authentication.

What changed in the 2026 DMARC standard?

RFC 9989 replaced the earlier DMARC specification in May 2026. This generator uses shared policy and alignment tags and omits the historic pct, rf and ri tags. Start with p=none rather than relying on percentage-based enforcement.

Do I need an API key, account or paid reporting service?

No. Record generation runs in your browser without submitting the form. Optional DNS checks send only the two generated DNS names to this site’s DNS service and public resolver. Report email addresses are not sent by that check. You need a mailbox or reporting service able to receive and interpret aggregate XML reports; this tool does not receive or host them.

Official references

Standards and provider guidance

Reviewed October 2026. The generator omits deprecated percentage and reporting-interval tags.