Build SPF and DMARC records for your domain in a minute. Pick the services that send email for you, choose a DMARC policy and copy TXT records ready to paste into your DNS.
Why these records matter now
Since 2024, Gmail and Yahoo require anyone sending in bulk to authenticate their email with SPF, DKIM and DMARC. Even small senders see the difference: authenticated mail lands in the inbox far more often, and without a DMARC record anyone can send email that claims to be from your domain.
- SPF lists the servers allowed to send email for your domain.
- DKIM adds a signature to each email. Your email provider gives you this record; it can’t be generated here because the key comes from them.
- DMARC tells receiving servers what to do when an email fails those checks, and sends you reports.
Building your SPF record
Tick every service that sends email using your domain: your mailbox provider (Google Workspace, Microsoft 365, Hostinger and so on), your newsletter tool and any transactional service such as SendGrid or Amazon SES. Then add these points to your checklist:
- You can only have one SPF record. If one exists, replace it with the combined version.
- SPF allows at most 10 DNS lookups. Every
include,aandmxcounts, and includes can contain more lookups inside them. Remove services you no longer use. - End with
~allwhile you are getting set up. Switch to-allonly when you are certain every sender is listed.
Rolling out DMARC safely
Start with p=none and a reporting address. Nothing changes for your email, but you start receiving daily reports showing which servers send as your domain and whether they pass. After two to four weeks of clean reports, move to p=quarantine, and later to p=reject. Going straight to reject is the fastest way to lose real emails, such as invoices sent by a billing tool you forgot about.
Adding the records
Log in wherever your DNS is managed: your domain registrar, your host or Cloudflare. Add a TXT record with the host and value shown above. Changes usually work within an hour, though some providers take up to 48 hours. Our SPF, DKIM and DMARC setup guide for newsletter senders shows where to find each setting.
Common questions
Do I need DMARC if I only send a few emails?
It is still worth it. A DMARC record with p=none costs nothing, protects your domain from being spoofed and gives receiving servers one more reason to trust your mail.
What should the DMARC host be?
Use _dmarc as the host or name. Some DNS panels want the full _dmarc.yourdomain.com; the generator shows the short form most panels expect.
Can I have two SPF records?
No. Two SPF records make SPF fail completely. Merge all your includes into one record, which is what this generator does.
Where do I get my DKIM record?
From each service that sends for you. Google Workspace, Microsoft 365, Brevo, Mailchimp and others each have a DKIM page in their settings with the exact record to add.