SPF & DMARC Record Generator and Syntax Checker
Build the SPF and DMARC TXT records used to authenticate your outgoing mail from a simple form. Paste a record you already publish to check v=spf1, the position of all, the 10 DNS lookup limit, the pct range, and mailto: report addresses. No DNS queries are made, and what you enter is processed in your browser and never sent to a server. For related email links, see the mailto Link Generator.
🔒 Runs in your browser · Your data is never sent to a server
Shows the host name where the TXT record goes (an example.com sample is used while empty).
Build an SPF record
redirect only takes effect without all. Set "Final rule" to "None" to include it in the output.
Result
What to enter in your DNS
| Type | TXT |
|---|---|
| Host name (name) |
Check an existing record
How to use
- Choose "SPF" or "DMARC" and enter your own domain in "Domain".
- Set the form fields and the "TXT record value" is built as you go.
- Press "Copy record value" and add it as a TXT record at the "Host name (name)" shown.
- Paste a record you already publish into "Check an existing record" to validate it.
Notes
- This tool makes no DNS queries, so it cannot fetch what you currently publish or expand include targets. The lookup count only covers the pasted record; lookups made inside included records are not counted, so verify the real total including each include.
- Publish exactly one SPF record per domain. Several v=spf1 records cause a permerror, so merge them if you already have one.
- When rolling out DMARC, start with p=none and rua to collect reports, confirm your legitimate senders pass SPF or DKIM, and only then move to quarantine and reject. DKIM signing itself is configured in your mail service.
- If rua points to an address in a different domain, that domain may need a DNS record authorizing it to receive your reports.
- Some DNS panels expect only _dmarc as the host name, without the domain part. Follow your provider’s instructions. Changes take effect after the record’s TTL.
Glossary
SPF (Sender Policy Framework)
A DNS TXT record that declares which servers may send mail for a domain. Receivers compare the sending IP against it.
DMARC
A policy that checks whether SPF and DKIM results align with the visible From domain, tells receivers what to do with failures (none, quarantine, reject), and says where to send reports.
DKIM
A digital signature added to each message and verified with a public key published in DNS. DMARC passes if either SPF or DKIM passes with alignment.
Alignment (adkim / aspf)
How closely the authenticated domain must match the From domain. Relaxed accepts the same organizational domain; strict requires an exact match.
permerror
A permanent SPF error caused by syntax mistakes or exceeding the lookup limit. Most receivers treat SPF as failed in this case.
FAQ
What is the 10 DNS lookup limit in SPF?
While evaluating SPF, every include, a, mx, ptr, exists, and redirect triggers a DNS query. If the total goes past 10, receivers return a permerror and ignore your SPF. ip4, ip6, and all are free. Lookups made inside included records count too, so the real total can be higher than the estimate here, which only counts the pasted record.
Can I publish two SPF records?
No. More than one TXT record starting with v=spf1 on the same domain causes a permerror. When you add a new sending service, merge it into the existing record with another include or ip4 instead of creating a second record.
Should I use -all or ~all?
-all marks unlisted senders as fail and ~all as soft fail. A common path is to start with ~all while you are still finding every legitimate sender, then switch to -all once they are all listed. With DMARC in place, both are reported to DMARC as an SPF failure. Never use +all, which lets anyone send as your domain.
Is it safe to start DMARC with p=reject?
Not recommended. Legitimate senders that lack SPF or DKIM setup, such as an invoicing system or a newsletter service, could have their mail rejected. Start with p=none and rua to collect aggregate reports, confirm every legitimate sender authenticates, then tighten to quarantine and reject, using pct to ramp up gradually.
What happens when the record is longer than 255 characters?
A single TXT string holds at most 255 characters, so longer values are stored as several strings. Most DNS panels split them automatically; if yours does not, use the 255-character split shown by this tool. A whole DNS response above about 450 bytes may need TCP, which some receivers fail on, so for SPF it is safer to trim includes and IP lists.
Share this page