SPF & DMARC Record Generator

Build valid SPF and DMARC DNS records from a few simple choices — ready to copy straight into your DNS to protect your domain from email spoofing. Free, nothing stored.

1 · SPF — who can send your mail

2 · DMARC — your anti-spoofing policy

How to use the records

Add two TXT records in your DNS. The SPF record goes on your domain root (host @) and lists every server allowed to send your mail, ending with -all or ~all. The DMARC record goes at host _dmarc and tells receivers what to do when a message fails, plus where to send reports. Start DMARC at p=none to monitor, review the reports, then raise it to quarantine and reject. Keep SPF under 10 DNS lookups. When you're done, verify with the checker — and read the full SPF, DKIM & DMARC guide for the details.

More PAYATE tools

Subnet CalculatorIPv4 CIDR network ranges QR Code GeneratorURL or text to a QR code JSON to TypeScriptGenerate TS interfaces from JSON Text ToolsSort, dedupe & clean text

Frequently asked questions

What does this tool generate?

Two DNS TXT records: an SPF record that lists the servers allowed to send mail for your domain, and a DMARC record that sets your anti-spoofing policy and reporting address. You copy each into your DNS.

Where do I publish the records?

Publish the SPF record as a TXT record on your domain root (host @). Publish the DMARC record as a TXT record at the host _dmarc. After the DNS has propagated, verify both with the SPF/DKIM/DMARC Checker.

Which DMARC policy should I start with?

Start with p=none (monitor only) and a reporting address, review the reports for a few weeks to catch any legitimate senders that fail, then move to p=quarantine and finally p=reject for full protection. Don't start at reject.

What about DKIM?

DKIM keys are generated by your email provider (Google, Microsoft, SendGrid…), not here — you enable DKIM in their dashboard and they give you the record to publish. This tool builds the SPF and DMARC parts; for a full explanation see our SPF, DKIM & DMARC guide.