Free tool

SPF and DMARC generator

Pick your email providers and generate the exact TXT records you need to paste into your DNS.

Your domain (optional, only used to label the record)

SPF

Check the services that send mail on behalf of your domain. Each one adds a DNS lookup to the SPF budget.

Additional mechanisms (one per line, e.g. include:_spf.otherservice.com or ip4:203.0.113.5)

DNS lookups used: 0 of 10

What to do with mail that doesn't match

~all — soft fail — flagged as suspicious but usually still delivered. Recommended while you verify your provider list is complete.-all — hard fail — rejected outright. Only once you're sure no provider is missing from the list above.

TXT record for the root domain

v=spf1 ~all

DMARC

Roll out DMARC in stages: start at "none" with a reports email (rua) for a few weeks to see what would get rejected, and only then move to "quarantine" and finally "reject". Publishing "reject" from day one can make you stop receiving your own mail if something isn't configured right.

PolicyEmail to receive reports (rua)

Without a reports email, "none" is pointless — nobody sees what would be failing.

Percentage of mail affected (pct)

TXT record for _dmarc.tudominio.com

v=DMARC1; p=none;

DKIM

The DKIM record isn't generated here: your email provider (Google Workspace, Microsoft 365, SendGrid...) issues it, because it has to match the private key it signs your mail with. A record invented on this page wouldn't be signed by anyone and would be useless. Copy the TXT record your provider gives you and add it to your DNS alongside these two.

What about the rest of your domain?

SPF and DMARC are just email. Certificate, headers, ports: check it all for free in a minute with the full analyzer.

Analyze my domain See all tools