SPF and DMARC generator
Create the SPF and DMARC records that stop others sending email as your domain, ready to copy into your DNS.
Nothing leaves your browser: records are built and checked on this page, without DNS lookups.
How it works
SPF and DMARC are DNS TXT records that protect your domain against email spoofing. SPF lists the servers allowed to send your mail. DMARC tells receivers what to do when a message fails both SPF and DKIM alignment, and where to send reports. The generator builds both records from your choices, counts SPF lookups and flags common mistakes. It does not query DNS, so check the published records once they are live.
Rolling out DMARC
Start with p=none and a report address. The reports show every server sending as your domain; fix any legitimate sender that fails, usually by adding it to SPF or turning on DKIM signing. Then move to quarantine and finally to reject. RFC 9989 removed the old pct tag. Its test mode, t=y, asks receivers to apply one step less, but receivers that still follow RFC 7489 ignore it.
Limitations
Lookups are counted at the top level only, because included records are not fetched. The tool cannot see whether DKIM is set up, and DMARC needs it for mail that is forwarded.
Questions
Should I use -all or ~all?
Use -all once every legitimate sender is listed; ~all is gentler while you are still finding them. When DMARC is enforced, both count as an SPF failure.
Why is my DMARC record not found?
Check that it is at _dmarc.yourdomain, starts with v=DMARC1 and is the only one. Many DNS panels add your domain to the name, so enter only _dmarc as the host.
What happened to pct?
RFC 9989 removed the pct tag. To test a stricter policy, use t=y instead and watch the reports.
Do I need DKIM as well?
Yes. DMARC passes when either SPF or DKIM passes with alignment, and DKIM survives forwarding where SPF often fails. Turn on DKIM signing before enforcing DMARC.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Consulting and trainingRelated articles
-
How to spot a phishing link before you click
Learn to read a URL like an attacker builds it - registrable domains, lookalike and punycode domains, the @ trick, open redirects, shorteners and new TLDs.
-
SPF, DKIM and DMARC explained - a safe path to p=reject
How SPF, DKIM and DMARC stop others sending email as your domain, how to move from p=none to p=reject safely, and the mistakes that break mail.