🧾 SPF & DMARC Record Generator

Two records, built together

Email authentication needs two DNS records, and they belong together. SPF lists the services allowed to send mail as your domain. DMARC tells receivers what to do when a message fails SPF or DKIM, and where to send reports about it. This wizard builds both at once: tick the services that send your email, pick a DMARC policy, and copy the two TXT records into your DNS. Everything runs in your browser. Nothing you enter is sent anywhere or stored.

What you need before you start

Three things. First, the list of services that send mail as your domain: your mailbox provider, plus anything else, your newsletter service, your invoicing app, your online shop, your website's contact form. Every sender needs an include, and every sender you forget is mail that will fail. Second, an email address for DMARC reports, ideally a mailbox you actually read, on your own domain. Third, access to your DNS provider, where the records go.

Worked example: Google Workspace plus SendGrid

I run a small shop. Mail goes out through Google Workspace for day-to-day mail and SendGrid for order confirmations. I tick both, leave the policy at p=none, and add [email protected] as the report address. The wizard returns two records: v=spf1 include:_spf.google.com include:sendgrid.net ~all as a TXT record at host @, and v=DMARC1; p=none; rua=mailto:[email protected]; as a TXT record at host _dmarc. Both take effect within the hour on most DNS providers, though some caches hold the old values for up to 48 hours.

The lookup counter, and why it matters

SPF allows 10 DNS lookups per check. Every include, a, mx and redirect costs one, and includes nested inside includes count too. Cross the limit and SPF fails completely, which is worse than a weak record. The counter above the results shows your running total as you tick services. The counts are estimates, because providers change their own records without telling anyone. After you publish, run our SPF, DKIM and DMARC Checker to get the exact count for your published record.

Start soft, then tighten

The safe order is: publish with p=none and ~all, watch the DMARC reports for two to four weeks, and fix anything legitimate that fails. Then move DMARC to quarantine, and finally reject. Move SPF from ~all to -all only when you are sure every sender is listed, because -all tells receivers to reject anything unlisted, including the service you forgot. If you already have an SPF record, do not add a second one: paste it into the box above and the wizard merges the new includes into it. Two SPF records invalidate SPF entirely.

Where the records go

Both records are TXT records in your DNS. The SPF record goes at host @, your root domain. The DMARC record goes at host _dmarc. In Cloudflare that means a TXT record named @ and one named _dmarc. Other providers work the same way, though some want the full host (_dmarc.yourdomain.com) instead. Leave the TTL at your provider's default. Once published, verify them with our checker and send a real message through our Email Deliverability Test to see the verdicts live.

Frequently asked questions

Do I need DKIM as well?

Yes, and it comes from your mail provider, not from this wizard. Each sending service generates its own DKIM key pair: you switch DKIM on in the provider's settings and publish the public key it gives you. The wizard covers SPF and DMARC only, on purpose, because a DKIM key generated anywhere else would not match the private key your provider actually signs with.

What does p=none actually do?

It tells receivers to deliver everything as normal and send you reports about what passed and failed. It protects nothing by itself. It is the right starting point because it gives you evidence before you enforce anything, and the step to quarantine and then reject is what turns monitoring into protection.

Will these records break my email?

They can, which is why the wizard defaults to the soft settings: p=none and ~all. A typo in SPF can fail every message you send, and jumping straight to p=reject or -all is how people block their own invoices. Change one thing at a time and re-run the checker after each edit.

Why does my SPF include so many services?

Every service that sends as your domain needs an include: your mailbox provider, your newsletter service, your invoicing app, your shop, your contact form. The counter above the results shows the lookup cost. If it approaches 10, the fix is usually removing services you no longer use, not trimming the ones you do.

Why are Shopify and Brevo special?

Both usually need a sending subdomain for DMARC alignment, which means their include authorizes them for SPF but DMARC may still fail alignment on your root domain. Their own setup guides explain the subdomain step. The include values here are the ones both providers document.