SPF / DKIM / DMARC record generator
Build copy-ready DNS records for email authentication. No live lookups — use the dig commands below to verify. See also the DNS record explainer.
Sending providers (include:)
Host / name
@ (apex) or
TXT value
DNS lookups: ~ / 10 max
DKIM public keys come from your email provider — not generated here. Pick your provider for setup links and selector hints.
Host / name
.
TXT value
Host / name
_dmarc.
TXT value
Checking your setup
Run these in your terminal (replace domain/selector):
About this tool
SPF lists who may send mail for your domain. Eachinclude: counts toward the 10 DNS lookup cap — go over and receivers may soft-fail even valid mail. DKIM signs messages with a public key your provider gives you; this tool formats the TXT record, it does not generate keys.
DMARC tells receivers what to do when SPF or DKIM fail. Start withp=none and aggregate reports before quarantine or reject. All three records are TXT entries at different hostnames. This page does not query DNS live — copy thedig commands and verify propagation yourself.