Answer a few questions and get a ready-to-publish SPF or DMARC TXT record for your domain.
SPF (Sender Policy Framework) lists which servers are allowed to send mail for your domain. DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving mail servers what to do when a message fails SPF and/or DKIM, and where to send reports about it. Both are published as TXT records: SPF on the domain itself, DMARC on _dmarc.yourdomain.com.
~all.p=none and a rua address, and just watch the reports for a few weeks.p=quarantine once the reports show only mail you recognize is passing.p=reject once you're confident nothing legitimate is being flagged.Before changing anything, look up your domain's current SPF and DMARC records.
Run the Email DNS CheckHand-writing SPF and DMARC records is easy to get subtly wrong: a missing quote, a wrong mailto: prefix, an accidental second SPF record, or an "all" qualifier that does the opposite of what you intended. This generator builds both record types from a guided form so the syntax is correct by construction, and flags common risks (too many SPF DNS lookups, a +all catch-all, a DMARC reject policy with no reporting address) before you publish anything.
SPF and DMARC are meant to be rolled out in order: get SPF right first, then publish DMARC starting at a monitoring-only policy before moving to enforcement. This tool supports both stages, so you can generate a safe starting DMARC record now and regenerate a stricter one later without starting from scratch.
If you need related checks, try Check SPF check online and DMARC check check tool.
Yes. Pick your mail providers, IP ranges, and policy in the form, and the tool builds a complete record from scratch. You do not need an existing record to start from.
SPF evaluators stop after 10 DNS-lookup mechanisms (include, a, mx, ptr, exists, redirect) and treat the record as a permanent error if exceeded. The generator counts these as you add mail providers so you can see the running total before you publish.
Generally yes. p=none only monitors and reports, without blocking or quarantining any mail, which lets you review reports before enforcing anything. Move to quarantine and then reject once you have confirmed all your legitimate senders pass.
A domain must publish only one SPF TXT record. If you already have one, use this tool to build a replacement that includes everything from your old record plus anything new, then swap it in as a single record rather than adding a second one.
Not strictly, DMARC can reference SPF alignment alone, but DMARC is far more effective when both SPF and DKIM are in place, since receivers only need one of the two to align. Set up DKIM with your mail provider alongside this.
SPF goes on your domain's apex as a TXT record. DMARC goes on _dmarc.yourdomain, also as a TXT record. The generator shows the exact record name for the one you built.