Free Tool
SPF & DMARC Record Generator
Build correct email authentication records for your domain. Select your senders, set your policy, and copy the ready-to-add TXT record.
Which services send email for your domain?
Check all that apply. Each adds an include: mechanism to your record.
Separate multiple domains with commas or spaces. Each is added as include:domain.
IPv4 or IPv6, with optional CIDR range. Added as ip4: or ip6:, which cost no DNS lookups.
Enforcement policy
Configure your DMARC policy
Start with p=none to monitor, then tighten once you're confident all legitimate mail passes.
Policy (p=)
Receives daily XML reports of all senders claiming to be your domain. If this address is on a different domain, that domain must publish a DNS record authorizing it to receive your reports.
Percentage of failing messages the policy applies to. Leave at 100% (the default, so it's left out of the record) unless you're phasing in quarantine or reject.
Override the policy for subdomains.
Generated Record
Add as a TXT record at @ in your DNS provider
Understanding SPF and DMARC
What SPF protects against
SPF (Sender Policy Framework) lists which mail servers are authorized to send on your behalf. Without it, anyone can send email that appears to come from your domain, a tactic used in phishing and business email compromise attacks. Set it as a TXT record at your root domain.
What DMARC adds
DMARC tells receiving servers what to do when SPF or DKIM fails: nothing (none), move to spam (quarantine), or block entirely (reject). It also enables aggregate reports: daily XML digests showing exactly who is sending email using your domain.
Softfail (~all) vs. hardfail (-all)
Softfail marks unauthorized senders as suspicious but still delivers them. Hardfail tells receivers to reject them outright. Start with ~all while confirming all your legitimate senders are included, then move to -all once email is flowing correctly.
DMARC rollout strategy
Start with p=none to monitor without blocking. Review the aggregate reports (rua) for 2–4 weeks to identify all senders. Move to p=quarantine, then p=reject once you're confident no legitimate mail is failing authentication.
What do SPF endings like ~all and -all mean?
| Ending | Name | What receivers do with unauthorized senders |
|---|---|---|
| -all | Hard fail | Reject or treat as failed. The strictest setting. |
| ~all | Soft fail | Accept but mark as suspicious. A common, safe starting point. |
| ?all | Neutral | Nothing. Provides no protection. |
| +all | Pass | Accept everything. Authorizes any server to send as your domain. Never use it. |
Need a hand?
Not sure which senders to include?
We inventory every service that sends mail as your domain, publish the right records, and roll DMARC to enforcement without breaking legitimate email.