SPF & DMARC record generator

Q: Where do I add these records?

In your DNS provider (often your domain registrar, Cloudflare or your web host). Add each as a TXT record: SPF on the domain itself (host @) and DMARC on the host _dmarc. Changes can take up to a few hours to appear.

Build a valid SPF record from your email providers and servers, and a DMARC record with the right policy and reporting addresses, ready to paste into your DNS.

Runs in your browser. Nothing you enter is looked up, sent or stored.

SPF record

Services that send email for you

Other includesIPv4 addresses or rangesIPv6 addresses or ranges

Allow this domain's MX servers (mx)Allow this domain's own IP (a)

Mail from anywhere else

Type: TXT
Host / name: @ (the domain itself)

v=spf1 ~all

Each include counts towards SPF's limit of 10 DNS lookups, and providers' includes often contain more. Check the finished record with the SPF checker once it's published.

DMARC record

Policy (p)Subdomain policy (sp)Apply to % of failing mail (pct)

Send aggregate reports to (rua)DKIM alignment (adkim)SPF alignment (aspf)

Type: TXT
Host / name: _dmarc

v=DMARC1; p=none

Start with p=none and a rua address, read the reports for a few weeks to confirm every real sender passes, then move to quarantine and finally reject.

How it works

Pick the services that send email for you, add any servers of your own, and choose a policy. The generator writes a single valid SPF record and a DMARC record, with where to put each in DNS. It checks addresses and ranges as you type and warns when you're close to SPF's 10-lookup limit.

After publishing, run the SPF, DMARC & DKIM checker to confirm everything resolves. Provider includes change occasionally, so confirm them on each provider's setup page.

Questions

Where do I add these records?

In your DNS provider: often your domain registrar, Cloudflare or your web host. Add each as a TXT record: SPF on the domain itself (host @) and DMARC on the host _dmarc. Changes can take a few hours to appear.

I already have an SPF record. Can I add a second one?

No. A domain must have exactly one SPF record; with two, SPF fails for all your mail. Combine everything into one record, which is what this generator produces.

Should I use ~all or -all?

Both work with DMARC. ~all (soft fail) is the safer start while you confirm every sender is listed; -all (fail) is stricter. DMARC enforcement (p=quarantine or p=reject) is what actually stops spoofing.

What DMARC policy should I start with?

Start with p=none and a reporting address (rua), so you can see who sends mail as your domain without blocking anything. After a few weeks, once real senders pass, move to p=quarantine, then p=reject.