Marketing · Free Tool

SPF & DMARC Record Generator

Build correct SPF and DMARC DNS records for your domain: pick the services that send your email, choose a policy, and copy the TXT record with plain-English checks.

Services that send email as your domain
Type TXT Host / name @

    About this tool

    Gmail, Yahoo, and Outlook now expect bulk senders to authenticate their mail with SPF, DKIM, and DMARC, and messages that fail end up in spam or are rejected. This generator writes the two records you add yourself in DNS: an SPF record listing the services allowed to send as your domain, and a DMARC record telling mailbox providers what to do with mail that fails, and where to send reports.

    Tick the services you use (Google Workspace, Microsoft 365, Amazon SES, SendGrid, Mailgun, Postmark, and others), add any extra includes or IP addresses, and copy the result. The tool flags common mistakes as you go: too many DNS lookups, publishing two SPF records, and enforcing a DMARC policy without reports.

    Common uses

    • Set up email authentication for a new domain before sending campaigns
    • Add a new email or CRM service to an existing SPF record without breaking it
    • Roll out DMARC safely, from monitoring to quarantine to reject

    Frequently asked questions

    What is the difference between SPF, DKIM, and DMARC?

    SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature to each message, set up inside each sending service. DMARC ties them to the From address and tells receivers what to do when both fail, plus where to send reports.

    Should I use ~all or -all in SPF?

    Start with ~all (soft fail) while you confirm every legitimate sender is listed. Once DMARC reports show nothing legitimate failing, -all is stricter; in practice DMARC policy matters more than the SPF qualifier.

    Which DMARC policy should I start with?

    p=none with a report address. Read the reports for a few weeks, fix any legitimate senders that fail, then move to p=quarantine and finally p=reject.

    Is my data uploaded to a server?

    No. This tool runs entirely in your browser using JavaScript, so nothing you type is transmitted, logged, or stored anywhere. You can even use it offline once the page has loaded.