SPF and DMARC Generator
Pick your senders and DMARC policy, then copy an SPF and DMARC record ready for DNS.
This tool builds the text of an SPF and DMARC record entirely in your browser from what you choose in the form. Tick ready-made senders such as Google Workspace or Microsoft 365, or add your own server's ip4 or ip6 address, then set the qualifier and DMARC policy. You can also paste an existing record to load it back into the form. It does not connect to your domain's DNS to read the current record, that is what the email and DNS audit tool does.
The SPF standard limits the total number of mechanisms that require a DNS lookup (include, a, mx, exists, redirect) to 10; the tool shows this counter as you add each one and warns as you approach the limit. As the final qualifier, -all rejects servers without authorisation, ~all applies a soft fail, and +all cannot be selected because it would authorise anyone to send. DMARC policy tightens in stages, starting at none while you read reports from your rua and ruf addresses, moving to quarantine, then reject.
The tool does not publish the record for you, you add the generated name, type and value yourself in your DNS provider's panel. A domain can only publish one SPF TXT record, adding a second one invalidates both, and the tool has no way to know whether one already exists. Keep the policy at none long enough to see every legitimate sending source in your reports before moving towards reject.
FAQ
How many includes can I add?
The SPF standard limits the total of mechanisms that need a DNS lookup (include, a, mx, exists, redirect) to 10; the tool shows this counter as you add each one and warns as you get close.
Why can't I choose +all?
+all would authorise anyone to send mail as your domain, which makes SPF pointless, so the form only offers -all, ~all and ?all as qualifiers.
Should I set DMARC straight to reject?
No, start with none and watch the reports sent to your rua address until you have identified every legitimate sending source, then move to quarantine and finally reject.
Is anything I enter stored anywhere?
No, the record is built entirely in your browser and nothing is sent to a server; a record you paste in is only parsed on the same page.
