Where do I publish these DNS records?

SPF goes as a TXT record on your bare domain (@ or example.com). DMARC goes on _dmarc.example.com as a TXT record. DKIM goes on ._domainkey.example.com — the exact selector is provided by your email service provider.

Which DMARC policy should I start with?

Always start with p=none to collect reports without affecting mail delivery. Once you have analysed the rua reports and confirmed all legitimate senders are covered by SPF or DKIM, advance to p=quarantine and then p=reject.

Where do I get my DKIM public key?

Your email service provider (Google Workspace, Microsoft 365, SendGrid, Mailgun, etc.) generates the RSA or Ed25519 key pair for you. Find the public key in their admin panel under DKIM or domain authentication settings, then paste the Base64 value here.

DMARC, SPF & DKIM Record Generator

NEW

Build correct SPF, DMARC, and DKIM DNS TXT records without memorising the syntax. Fill in the fields — IPs, include domains, policy, reporting addresses, DKIM selector and public key — and copy the ready-to-paste record strings instantly.

SPF Record

Specify which servers are authorised to send email for your domain.

Allowed IP addresses / ranges (one per line, e.g. 203.0.113.5 or 198.51.100.0/24) include: domains (one per line, e.g. _spf.google.com)

Fail policy

~all — SoftFail (recommended) -all — HardFail (strict) ?all — Neutral

DNS TXT record — @ or your-domain.com

v=spf1 ~all

DMARC Record

Domain-based Message Authentication, Reporting & Conformance policy.

Policy (p=)

none — Monitor only quarantine — Junk / quarantine reject — Reject (strictest)

Aggregate reports (rua=) Forensic reports (ruf=)

Percentage to apply policy to (pct=)

100%

DNS TXT record — _dmarc.your-domain.com

v=DMARC1; p=none; pct=100

DKIM Record

Paste the public key from your mail provider to build the TXT record.

Selector (e.g. google, mail, s1) Key type

Public key (Base64, without -----BEGIN PUBLIC KEY----- header/footer)

DNS TXT record — <selector>._domainkey.your-domain.com

v=DKIM1; k=rsa; p=

Host name: default._domainkey

Send output to:

How to use DMARC / SPF / DKIM Generator

Enter the allowed IP addresses and include domains for your SPF record, choose a fail policy, and copy the generated TXT value to the @ record of your domain.
Select a DMARC policy (none to start monitoring, quarantine or reject for enforcement), add your reporting email addresses, and copy the record to _dmarc.your-domain.com.
Paste your DKIM public key from your mail provider, set the selector and key type, then copy the TXT record to <selector>._domainkey.your-domain.com.

What is DMARC / SPF / DKIM Generator?

SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting and Conformance) are three DNS-based email authentication standards that work together to prevent spoofing and phishing. Without them, anyone can forge your domain in the From header of an email.

SPF lists the mail servers authorised to send on behalf of your domain. DKIM adds a cryptographic signature to outgoing messages that receiving servers verify against a public key published in DNS. DMARC ties the two together with a policy that tells receiving servers what to do with messages that fail authentication, and where to send aggregate and forensic reports.

FAQ

Where do I publish these DNS records?: SPF goes as a TXT record on your bare domain (@ or example.com). DMARC goes on _dmarc.example.com as a TXT record. DKIM goes on <selector>._domainkey.example.com — the exact selector is provided by your email service provider.
Which DMARC policy should I start with?: Always start with p=none to collect reports without affecting mail delivery. Once you have analysed the rua reports and confirmed all legitimate senders are covered by SPF or DKIM, advance to p=quarantine and then p=reject.
Where do I get my DKIM public key?: Your email service provider (Google Workspace, Microsoft 365, SendGrid, Mailgun, etc.) generates the RSA or Ed25519 key pair for you. Find the public key in their admin panel under DKIM or domain authentication settings, then paste the Base64 value here.

Related tools

People also use

Email DNS Checker
🌐 Network & Domain Tools
Check a domain's MX mail servers, SPF record, and DMARC policy in seconds. Instant green/red status for each email deliverability record.

← Back to Network & Domain Tools · All tags

Last updated: 2026-06-02