SPF and DMARC Record Generator
Pick your senders and policy, and get the exact TXT records to publish. Everything is built in your browser; nothing you enter is sent anywhere.
Your SPF record
Add as a TXT record. Host: @ (the bare domain). One SPF record per domain.
Your DMARC record
Add as a TXT record. Host: _dmarc.
The live checks read what is published for your domain, so publish the records first. DKIM is set up in each sending service; see the provider pages.
How to use this tool and read the results
Tick the services that send mail as your domain, add any IP addresses or other includes, choose how strict to be, and the SPF record is built as you go. The DMARC section does the same for the policy, report address and alignment. Both records are assembled in your browser and nothing you enter is sent anywhere.
The generator warns about the usual mistakes: a record that needs more than 10 DNS lookups, a neutral policy that tells receivers nothing, reject with no report address, and a record longer than 255 characters. It cannot know your sending services unless you list them, so go through your helpdesk, billing, newsletter and website forms before you decide the list is complete.
Publish the records, then confirm them with the SPF checker, the DMARC checker and the DKIM checker. For the background read SPF, DKIM and DMARC explained, or go to the setup page for your provider from that guide.
Frequently asked questions
How do I create an SPF record?
List every service that sends mail as your domain, add each one as an include or an IP range, and end the record with ~all or -all. Publish it as a single TXT record on the bare domain. This generator builds the record from your choices.
Should I use ~all or -all in my SPF record?
Start with ~all (soft fail) while you confirm that every sender is listed, then move to -all (fail) once the DMARC reports show nothing legitimate is failing. Avoid ?all, which tells receivers nothing.
What should my first DMARC record be?
Start with p=none and a rua address so you receive reports without affecting delivery. Read them for two to four weeks, fix any legitimate sender that fails, then move to quarantine and finally reject.
Can I have more than one SPF record?
No. A domain must publish exactly one TXT record starting with v=spf1. If you use several services, put all of them in the same record rather than adding a second one.
Does the generator send my data anywhere?
No. The records are built by JavaScript in your browser from what you type. The only network request is when you choose to run one of the live checkers on your domain.