SPF, DKIM & DMARC Record Generator

Configuration

Domain (e.g., example.com)

Authorized Senders

Allow MX servers Servers listed in domain's MX records can send mail

Allow A record IP The domain's primary A/AAAA record IP can send mail

Allow IPv6 (AAAA) Add ip6: mechanism for IPv6 address of A record

Third-Party Includes

Provider include: entries

Common Providers

Additional IP Addresses

IPv4 addresses (one per line)

IPv6 addresses (one per line)

Enforcement Policy (all)

Policy

Policy guidance

ℹ ~all (SoftFail): Unauthorized mail is tagged but delivered. Recommended while testing.

Generated SPF Record

DNS Record Type TYPE

TXT

Host / Name HOST

TXT Value RECORD

v=spf1

TTL TTL

3600 (1 hour — standard for SPF)

SPF Mechanism Reference

v=spf1	Required version tag — must always be first
mx	Authorizes the MX servers defined for this domain
a	Authorizes the IP of the domain's A/AAAA record
include:	Delegates authorization to another domain's SPF record (counts toward lookup limit)
ip4:	Authorizes a specific IPv4 address or CIDR range (e.g., ip4:203.0.113.0/24)
ip6:	Authorizes a specific IPv6 address or prefix
-all	Hard fail — reject unlisted senders (recommended for production)
~all	Soft fail — tag unlisted senders (recommended while testing)
?all	Neutral — take no action on unlisted senders

Configuration

Domain (e.g., example.com)

Selector (e.g., google, mail, s1)

Key Algorithm

Public Key (Base64) — paste the key from your provider, without headers

Optional Tags

Restrict to exact domain only Adds s=email — prevents use on subdomains

Testing mode Adds t=y — signals receivers key is in testing

Generated DKIM Record

DNS Record Type TYPE

TXT

Host / Name HOST

Enter domain & selector above

TXT Value RECORD

Complete the form above

TTL TTL

3600 (1 hour — standard for DKIM)

DKIM Tag Reference

v=DKIM1	Required version tag — must always be first
k=rsa	Key type — rsa (default) or ed25519
p=<key>	The Base64-encoded public key. If empty (p=), key is revoked
s=email	Service type restriction. Omit to allow all mail services
t=y	Testing flag — receivers should treat failures leniently
t=s	Subdomain restriction — key cannot be used by subdomains
h=sha256	Acceptable hash algorithms (sha256 or sha1)

ℹ Key source: Your DKIM public key is generated by your mail provider (Google Workspace, Microsoft 365, SendGrid, etc.). Retrieve it from your provider's DNS settings panel, then paste only the Base64-encoded key block here — without -----BEGIN PUBLIC KEY----- headers.

Domain & Policy

Domain (e.g., example.com)

Policy (p=)

Subdomain Policy (sp=) — leave empty to inherit p=

Percentage (pct=) — % of messages this policy applies to

100%

Strict DKIM alignment (adkim=s) Default: relaxed (r) — allows subdomains

Strict SPF alignment (aspf=s) Default: relaxed (r) — allows subdomains

Reporting Configuration

Aggregate Report Email (rua=) — daily summaries

Forensic Report Email (ruf=) — per-failure samples

Forensic Options (fo=) — when to generate forensic reports

Report Interval (ri=) — seconds between reports

Generated DMARC Record

DNS Record Type TYPE

TXT

Host / Name HOST

Enter domain above

TXT Value RECORD

Complete the form above

TTL TTL

3600 (1 hour — standard)

DMARC Tag Reference

v=DMARC1	Required version tag — must always be first
p=	Policy: none (monitor), quarantine (spam), reject (block)
sp=	Subdomain policy override — defaults to p= if omitted
pct=	Percentage of mail to apply policy to (0–100). Start at 10% when deploying
rua=	URI for aggregate XML reports (mailto: or https:). Highly recommended
ruf=	URI for forensic/failure reports. Contains sample message data — use carefully
adkim=	DKIM alignment: r=relaxed (default), s=strict (exact domain match)
aspf=	SPF alignment: r=relaxed (default), s=strict (exact domain match)
fo=	Forensic reporting trigger: 0=all fail (default), 1=any fail, d=DKIM, s=SPF
ri=	Report interval in seconds. Default: 86400 (24 hours)

⚠ Deployment tip: Always start with p=none; pct=10 and a rua= address. Monitor aggregate reports for 2–4 weeks before progressing to quarantine or reject. Jumping to reject immediately can silently drop legitimate email.