SPF and DMARC Record Generator
Build the two DNS records that stop other people sending email as your domain. Pick who sends your mail, copy the result into your DNS, and then check it worked. Everything is built in your browser. Nothing you enter is sent anywhere.
SPF: who may send mail for your domain
Tick every service that sends mail using your domain, including newsletter and invoicing tools.
DMARC: what to do with mail that fails
How to add these records
Open the DNS settings wherever your domain is managed, which is usually your registrar or hosting panel. Add each record as type TXT, using the host shown above the record. Some panels want the full name, such as _dmarc.example.com, instead of the short form.
A domain must have only one SPF record. If you already have one, edit it instead of adding a second, because two SPF records make the check fail outright. Once the records are live, run your domain through the DMARC, SPF and DKIM Checker to confirm what receivers will see.
A safe order for rolling out DMARC
| Step | Record | What to do |
|---|---|---|
| 1 | p=none with reports | Nothing is blocked. Collect reports for a few weeks and open them in the DMARC Report Reader. |
| 2 | Fix your senders | Every service you recognise in the reports should pass SPF or DKIM in alignment with your domain. |
| 3 | p=quarantine | Failing mail goes to spam. Watch for real mail that gets caught. |
| 4 | p=reject | Failing mail is refused. This is the setting that actually stops spoofing of your domain. |
Stopping at p=none gives you visibility but no protection. Jumping straight to p=reject without reading reports can block your own invoices and newsletters.
What this generator can’t do
It can’t create DKIM. DKIM keys come from whichever service sends your mail, so you turn it on in that service’s settings and publish the record it gives you. DMARC works best with DKIM in place, because SPF often breaks when mail is forwarded.
It can’t count your real SPF lookups. SPF allows ten DNS lookups in total, and each include can use several of its own. The count shown here covers only the terms you added. The checker follows every include and gives the true total once your record is published.
It can’t know your senders. If you leave out a service that sends real mail, that mail may start failing. Check your reports before tightening anything.
Frequently asked questions
Should I use ~all or -all?
With DMARC in place, either works, because DMARC makes the final decision. ~all is the usual choice while you are still finding your senders, and -all suits a domain whose senders are all known.
What if my domain never sends email?
Publish v=spf1 -all and a DMARC record with p=reject. That tells receivers nothing legitimate ever comes from it. To get that SPF record here, leave every box empty and choose -all.
Why is my report address on another domain not receiving anything?
If reports go to a different domain, that domain must publish a record agreeing to receive them. Reporting services usually set this up for you.
How long until it takes effect?
Usually minutes to hours, depending on your DNS settings. You can watch it spread with the DNS Propagation Checker.