Skip to content
TextArray1.41.0
100% local

SPF and DMARC record generator

Build ready-to-paste SPF and DMARC DNS records from your senders and policy.

Output
Related tools
SPF and DMARC checkernewDeveloper tools
Email header analyzernewDeveloper tools
Robots.txt generatorDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
SPF and DMARC record generator
Enter the services and addresses allowed to send mail for your domain, and this tool assembles the matching SPF and DMARC TXT records — syntax ready to paste directly into your DNS zone. It is built for anyone setting up email authentication: a developer configuring a new domain, an admin tightening deliverability, or anyone auditing what a mail setup should look like before publishing it.
Add permitted senders as IP addresses, CIDR ranges or domains — a plain domain becomes an "include:" mechanism automatically. Presets add the correct include for Google Workspace, Microsoft 365, SendGrid or Mailgun with one click, so you don't need to look up their SPF hostnames. Choose how strictly SPF should fail unauthorized senders, then set the DMARC policy — monitor only, quarantine or reject — along with the percentage of mail it applies to, the interval between aggregate reports, and where reports should be sent. SPF and DKIM alignment can each be set to relaxed or strict, and a separate policy can be applied to subdomains.
The live output updates as you change any option, and the tally reports how many senders were resolved and how many of SPF's 10 allowed DNS lookups they use — going over that limit causes receivers to treat the whole record as a permanent error, so it's worth watching before you publish. Turn on hostnames to see each record next to the exact name it belongs at (the domain itself for SPF, "_dmarc." plus the domain for DMARC).
Everything runs in your browser. The domain, sender list and report addresses you enter are never uploaded or logged — nothing leaves your device. When you're happy with the result, copy it, download it as a .txt file, or send it to another tool to check it further.
FAQ
Why does the SPF record end in "-all" by default?
A hard fail ("-all") tells receiving servers to reject mail from any sender not explicitly listed — the strictest and generally recommended setting. Switch to soft fail ("~all") while you are still testing a new configuration.
What happens if I add more than 10 SPF lookups?
RFC 7208 caps SPF at 10 DNS lookups per check. Records over that limit can be treated as a permanent error by receivers, so the tool tracks the count in the tally as you add senders and presets.
Can I publish this record with no permitted senders at all?
Yes — with nothing selected the tool produces "v=spf1 -all", which correctly declares that the domain sends no mail. That is useful for parked domains you want to protect from being spoofed.
What does the DMARC "policy share" percentage do?
It applies the chosen policy (quarantine or reject) to only that percentage of failing mail, with the rest treated as monitor-only. It is meant for a gradual rollout — most domains raise it to 100% once they trust their SPF and DKIM setup.
Is my domain or sender list uploaded anywhere?
No. The records are assembled entirely in your browser — nothing you enter is sent to a server or stored anywhere outside your device.