SPF, DKIM & DMARC Record Generator
Create the three DNS records that prove your email is genuine: an SPF record with a DNS lookup counter, a DKIM key pair generated in your browser, and a DMARC policy with reporting. Paste any existing record into the checker to validate it tag by tag.
Private by design: anything you enter is processed in your browser only. It is never uploaded to or logged on our servers. DKIM private keys are generated with your browser's Web Crypto API and are never put in share links.
Enter a valid domain name such as example.com.
About SPF, DKIM and DMARC
Email was designed without sender authentication, so anyone can put your domain in the From line. Three DNS TXT records fix that. SPF (Sender Policy Framework) lists the servers allowed to send mail for the envelope sender (Return-Path) domain. DKIM (DomainKeys Identified Mail) has your mail server sign each message with a private key; receivers fetch the matching public key from DNS and verify that the message was not altered. DMARC ties the two to the visible From domain and tells receivers what to do when neither SPF nor DKIM passes in alignment: nothing, quarantine or reject.
SPF has a hard limit of 10 DNS lookups per evaluation. Every include, a, mx, ptr, exists and redirect counts, including the ones nested inside the providers you include, while ip4, ip6 and all are free. Exceeding the limit causes a permerror, which DMARC treats as an SPF failure. A domain must also have exactly one SPF record: two v=spf1 TXT records are also a permerror, so add new senders to the existing record instead of creating another.
DKIM keys live at <selector>._domainkey.<domain>, so you can publish several keys at once (one per provider, or a new one during rotation). Use 2048-bit RSA keys: 1024-bit keys are considered weak. A 2048-bit public key is about 400 characters, longer than the 255-character limit for a single DNS string, so it must be published as several quoted strings in one TXT record; most DNS dashboards split it for you, and this tool also shows the split form for BIND-style zone files. Many providers (Google Workspace, Microsoft 365, SendGrid) generate the key for you; use the generator here when you run your own mail server.
Since February 2024, Google and Yahoo require bulk senders (roughly 5,000+ messages a day to their users) to authenticate with SPF and DKIM and to publish a DMARC record, at least p=none, with the From domain aligned to SPF or DKIM. Start with p=none and aggregate reports, then move to quarantine and reject. After publishing, check the records with dig as shown below, find the public IP of your own mail server with What Is My IP for an ip4: entry, and decode a DKIM public key with the Base64 decoder if you need to inspect it.
Reference Guide
Where each record goes
| Record | Type | Host / name | Example value |
|---|---|---|---|
| SPF | TXT | @ (example.com) | v=spf1 include:_spf.google.com ~all |
| DKIM | TXT | s1._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkq… |
| DMARC | TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@example.com |
SPF mechanisms
| Term | Matches | DNS lookup |
|---|---|---|
ip4:203.0.113.0/24 | An IPv4 address or CIDR range | No |
ip6:2001:db8::/32 | An IPv6 address or range | No |
a, a:host | The A/AAAA addresses of the domain or host | Yes |
mx, mx:host | The domain's MX servers | Yes |
include:domain | Passes if that domain's SPF record passes | Yes, plus its own lookups |
exists:domain | Passes if the name has an A record (used with macros) | Yes |
ptr | Reverse DNS. Deprecated by RFC 7208; do not use | Yes |
redirect=domain | Use another domain's SPF record when nothing else matched | Yes |
-all / ~all / ?all | Everything else: fail / soft fail / neutral. +all allows anyone and must never be used | No |
DMARC tags
| Tag | Values | Meaning |
|---|---|---|
v | DMARC1 | Version; must be the first tag |
p | none | quarantine | reject | Policy for the domain (required) |
sp | same as p | Policy for subdomains (defaults to p) |
pct | 0–100 (default 100) | Percentage of failing mail the policy is applied to |
rua | mailto: URIs, comma separated | Where daily aggregate (XML) reports are sent |
ruf | mailto: URIs | Per-message failure reports (few receivers send them) |
adkim / aspf | r (default) | s | Relaxed allows subdomains to align; strict needs an exact domain match |
fo | 0 (default), 1, d, s | When failure reports are generated |
ri | seconds (default 86400) | Requested aggregate report interval |
DKIM tags
| Tag | Meaning |
|---|---|
v=DKIM1 | Version (optional, but must be first if present) |
k=rsa | Key type: rsa (default) or ed25519 |
p=… | Base64 public key. An empty p= means the key has been revoked |
h=sha256 | Allowed hash algorithms (optional) |
t=y / t=s | Testing mode / strict domain matching (optional) |
s=email | Service type (optional, default *) |
Verify after publishing
| Record | Linux / macOS | Windows |
|---|---|---|
| SPF | dig TXT example.com +short | nslookup -type=TXT example.com |
| DMARC | dig TXT _dmarc.example.com +short | nslookup -type=TXT _dmarc.example.com |
| DKIM | dig TXT s1._domainkey.example.com +short | nslookup -type=TXT s1._domainkey.example.com |
DNS changes can take up to the record's TTL to appear everywhere. Send a test message to a Gmail account and use "Show original" to confirm SPF, DKIM and DMARC all report PASS.
Example input
domain: example.com SPF: Google Workspace + SendGrid + ip4:203.0.113.10, ~all DKIM: selector s1, RSA 2048 DMARC: p=none; rua=mailto:dmarc-reports@example.com
This sample loads automatically when you open the tool. Use Load Sample to bring it back.
Frequently Asked Questions
SPF lists the servers allowed to send mail for your domain, DKIM signs each message with a key published in DNS, and DMARC tells receivers what to do when a message fails those checks and where to send reports.
No. A domain must publish exactly one SPF TXT record. Multiple records cause a permanent error. Combine all senders into one record with several include mechanisms.
SPF evaluation may perform at most 10 DNS lookups. Each include, a, mx, ptr, exists and redirect counts, including those nested inside includes. Exceeding it makes SPF fail, so the generator counts lookups for you.
Start with p=none and a rua report address to see who sends mail as your domain. Once legitimate senders pass SPF or DKIM, move to p=quarantine and finally p=reject.
Related Tools
All DevOps Tools →Dockerfile Linter
Lint a Dockerfile for security and best-practice issues: unp...
Docker Compose Validator
Validate docker-compose.yml files: YAML syntax, service keys...
Kubernetes YAML Linter
Lint Kubernetes manifests for errors and best practices: mis...
Excel to PDF Converter
Convert XLS, XLSX, ODS, and CSV spreadsheet files to PDF.
PDF to JPG Converter
Convert each page of a PDF into high-quality JPG files.
Watermark on PDF
Add a repeated text watermark to all pages in your PDF files...