SPF & DMARC generator
Email authentication
Build the DMARC and SPF records your domain needs
Choose a policy and the services that send mail for your domain, then copy the two TXT records into your DNS. Everything is built in your browser.
DMARC
Start here: nothing is blocked, and the reports show you every service sending as your domain.
- Host
_dmarc.example.com- TXT
v=DMARC1; p=none
SPF
Who sends email for this domain? Tick every service you use.
DNS lookups in this record: 1 of the 10 allowed, before counting the ones inside each include.
- Host
example.com- TXT
v=spf1 mx ~all
A domain can publish only one SPF record. If one exists, replace it with this one instead of adding a second.
How the two records work
DMARC is a TXT record at _dmarc.yourdomain. It tells receiving servers what to do with mail that claims to be from your domain but fails authentication, and where to send daily reports about it.
SPF is a TXT record on the domain itself listing the servers allowed to send its mail. Each include costs DNS lookups, and more than 10 in total breaks the record.
A safe rollout: publish SPF and DMARC with p=none and a report address, read the reports for a couple of weeks, fix any legitimate sender that fails, then move to quarantine and finally reject.