SPF & DMARC Record Generator
Generate SPF and DMARC DNS records for email authentication, and test existing records for any domain
Build an SPF TXT record to authorize which servers may send email on behalf of your domain.
Click a provider to add its include. Hover for description.
Build a DMARC TXT record to tell receivers how to handle email that fails SPF or DKIM checks.
Query live DNS TXT records for a domain and inspect SPF / DMARC configuration.
About this tool
SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance) are the two DNS TXT records that protect your domain from email spoofing. Together with DKIM they form the foundation of email authentication — without them, anyone can send email that appears to come from your domain. Google and Yahoo now require both for bulk senders (5,000+ emails/day), and most inbox providers use them to decide whether to deliver, quarantine, or reject messages.
SPF Generator: tick the mechanisms your domain uses (a, mx,
ip4, ip6, include), pick a qualifier (+ / - / ~ / ?), and optionally
add common providers like Google Workspace or Microsoft 365. The tool builds a valid SPF record and
warns about common mistakes like exceeding the 10-lookup limit.
DMARC Generator: choose a policy (none to monitor, quarantine
to send failures to spam, reject to block), set DKIM/SPF alignment, and optionally add
rua addresses to receive aggregate reports. The DNS Tester queries Google Public DNS for
existing TXT records and highlights which SPF and DMARC records are already published.
FAQ
What is the difference between SPF, DKIM, and DMARC? ›
SPF authorizes which IP addresses may send email for your domain. DKIM adds a cryptographic signature to each message. DMARC tells receivers what to do when a message fails SPF or DKIM (none / quarantine / reject) and where to send reports. All three work together — DMARC enforces SPF and DKIM.
Where do I publish these records? ›
SPF is a TXT record on your root domain (e.g. example.com). DMARC is a TXT record on the _dmarc subdomain (_dmarc.example.com). Add them through your DNS provider's control panel — Cloudflare, Route 53, GoDaddy, etc.
Why does my SPF record fail validation for too many lookups? ›
SPF has a hard limit of 10 DNS lookups per evaluation (the "10-lookup limit"). Every include, a, mx, ptr, exists, and redirect counts as one lookup. Nested includes count too. The tool warns when your record might exceed this limit. Solutions: flatten your SPF by replacing includes with ip4/ip6 subnets, or use a service that does SPF flattening.
Can I test records for any domain with the DNS Tester? ›
Yes. The tester queries Google Public DNS (dns.google) for TXT records on the bare domain and the _dmarc subdomain. It parses the results and surfaces SPF records (those starting with "v=spf1"), DMARC records ("v=DMARC1"), and common issues like multiple SPF records, missing DMARC, or p=none policies.