SPF, DKIM & DMARC Generator
Build your email authentication DNS records — SPF, DKIM and DMARC — with guided options and live validation, entirely in your browser. Warnings explain the RFC limits as you go; nothing is ever sent anywhere.
SPF, DKIM & DMARC
v=spf1 · v=DKIM1 · v=DMARC1SPF lists the servers allowed to send mail for your domain. Publish the result as a TXT record on the domain itself (name @); a domain should have only one. Add the senders you really use, usually your mail provider's include:, and end with ~all while testing, then -all.
Mechanisms
TXT record
Record name: @
DKIM signs every outgoing message with a private key kept by your mail provider; receivers check the signature with the public key you publish. The provider usually gives you the selector and the public key: paste the public key here and publish the result as a TXT record named selector._domainkey on your domain.
The tool never generates or receives your private key. Create a pair locally — for RSA: openssl genrsa -out dkim.pem 2048, then extract the public half with openssl rsa -in dkim.pem -pubout; for ed25519: openssl genpkey -algorithm ed25519 -out dkim.pem and openssl pkey -in dkim.pem -pubout. Paste only the public key here: it never leaves the page and is never placed in the URL.
TXT record
Record name:
DMARC tells receivers what to do with a message that fails SPF and DKIM alignment, and where to send reports. Publish it as a TXT record named _dmarc. Start with p=none and an rua address, read the reports for a few weeks, then move to quarantine and finally reject. It only works once SPF or DKIM is in place.
TXT record
Record name:
The options live in the URL, so a copied link reproduces the record; the DKIM public key never does. The record itself stays on the page — copy it into your DNS provider's zone editor.