UtilibyWritten by the Utiliby editorial team · Last updated October 15, 2026 · Rules and formulas reviewed October 2026
What this free online DMARC and SPF record generator does
Email was designed without a way to prove who sent a message, which is why anyone can write any From address. SPF, DKIM and DMARC are the three DNS-based standards that fix this, and Google, Yahoo and Microsoft now expect them from anyone who sends mail in volume. Writing the records by hand is error prone: one stray character, a second SPF record or too many lookups and the whole thing fails. This free online DMARC record generator and SPF record generator builds the records for you, checks them against the rules, shows the exact DNS entry to publish and lets you paste an existing record to see what is wrong.
On the DMARC tab you choose a policy, a share of mail to apply it to, report addresses and alignment modes, and a rollout visual shows where you are on the path from monitoring to reject. On the SPF tab you tick the services that send mail for you, such as Google Workspace, Microsoft 365, Mailchimp, SendGrid or Amazon SES, add IP addresses, and see an estimate of your DNS lookup count against the limit of 10. The Check tab explains every tag or term of a pasted record.
How to set up DMARC and SPF step by step
- List everything that sends mail for your domain: your mailbox provider, newsletter tool, billing system, help desk and website forms.
- Build your SPF record on the SPF tab. Tick each service, add any IP addresses and choose ~all to start.
- Publish it as a TXT record on your domain. Keep a single SPF record.
- Turn on DKIM in each sending service. They give you records to publish.
- Build your DMARC record with p=none and an rua address.
- Publish it as a TXT record named _dmarc.
- Read the reports for a few weeks. They show which sources pass and which fail.
- Tighten the policy to quarantine at a low percentage, then 100 percent, then reject.
DMARC tags explained
| Tag | Meaning | Typical value |
|---|---|---|
| v | Version, always first | DMARC1 |
| p | Policy for failing mail | none, quarantine, reject |
| sp | Policy for subdomains | Same as p if omitted |
| pct | Share of failing mail the policy applies to | 100 |
| rua | Aggregate report address | mailto:[email protected] |
| ruf | Failure report address | Optional |
| adkim, aspf | Alignment mode, relaxed or strict | r |
| fo | When to create failure reports | 0 |
| ri | Report interval in seconds | 86400 |
A safe DMARC rollout plan
- Stage 1, monitor: p=none with rua reports. Nothing is blocked. Find every legitimate sender and fix its SPF and DKIM.
- Stage 2, quarantine a little: p=quarantine; pct=25. A quarter of failing mail goes to spam.
- Stage 3, quarantine all: p=quarantine with no pct, then watch the reports again.
- Stage 4, reject: p=reject. Failing mail is refused. This gives the best protection against spoofing of your domain.
Move on only when reports show that your real mail passes. Aggregate reports are XML files, and many free and paid services turn them into dashboards.
SPF mechanisms and the 10 lookup limit
An SPF record is a list of terms. ip4 and ip6 allow an address range directly and cost nothing. include pulls in another domain's list and costs a lookup, plus any lookups that list uses. a and mx allow your own web or mail servers and cost a lookup each. all ends the record and says what to do with everyone else. The standard allows only 10 lookups per check, and exceeding it makes the record fail. Big providers use several nested lookups, which is why the generator counts Google Workspace as four. If you hit the limit, remove services you no longer use, send some mail from a subdomain with its own record, or replace includes with fixed IP ranges that you keep up to date.
Common mistakes to avoid
- Publishing two SPF records instead of merging them.
- Ending with +all or leaving out the all term.
- Going straight to p=reject and blocking your own invoices or newsletters.
- Forgetting a sender such as a CRM or support desk.
- Putting the DMARC record on the wrong host name. It must be _dmarc.yourdomain.com.
- Using a report address that bounces or that you never read.
- Forgetting DKIM, which DMARC relies on when mail is forwarded.
Check the rest of your email setup
Authentication is one part of deliverability. After you publish records, send a test message and examine it with the Email Header Analyzer to see whether SPF, DKIM and DMARC passed and aligned. Keep your list clean with the Email Validator and List Cleaner, check your wording with the Email Spam Word Checker and design a message with the HTML Email Template Builder.
Why email authentication matters now
Spoofed email is the root of most phishing and business email fraud. Large mailbox providers now require bulk senders to authenticate with SPF and DKIM and publish a DMARC policy, and they reject or spam-folder unauthenticated mail. Even small senders benefit: authenticated domains reach the inbox more often, brand logos and checkmarks may appear in some inboxes, and your domain is harder to impersonate.
Quick glossary
- Alignment: the domain that passed SPF or DKIM matches the domain in the visible From address.
- Aggregate report: a daily XML summary from a receiver showing which servers sent mail for your domain and whether it passed.
- Selector: the name that tells receivers which DKIM public key to fetch.
- TXT record: the type of DNS entry that holds SPF, DKIM and DMARC text.
- TTL: how long other servers may cache a DNS answer before asking again.
- Subdomain policy (sp): the rule for mail sent from names such as news.example.com.
- Spoofing: sending mail with a From address the sender does not control.
- Flattening: replacing include terms with fixed IP ranges to save SPF lookups.
Accuracy, limits and responsible use
The generator writes records from your input and checks their syntax. It does not look up DNS, so it cannot see other records on your domain, nested includes in real time or the real mail that uses your domain. Treat the lookup count as an estimate. Test any change with real messages and keep a copy of your old record in case you need to roll back.
Frequently asked questions
How do I create a DMARC record?
Enter your domain, choose a policy (start with none), add an email address for reports and copy the record. Publish it as a TXT record named _dmarc on your domain.
Is this DMARC and SPF record generator really free?
Yes. It is a free online tool with no sign-up. It runs in your browser and does not look up your DNS.
What is DMARC?
DMARC is an email authentication policy. It tells receiving servers what to do with mail that claims to be from your domain but fails SPF and DKIM checks with alignment, and it asks for reports.
What is SPF?
SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for your domain. Receivers compare the connecting server with the list.
What is the difference between SPF, DKIM and DMARC?
SPF lists permitted servers. DKIM signs messages so changes can be detected. DMARC requires one of them to pass in a way that matches the visible From domain and sets the policy.
Which DMARC policy should I choose?
Start with p=none to collect reports without affecting delivery. When reports show that all your legitimate mail passes, move to quarantine and finally reject.
What does pct do in DMARC?
pct applies the policy to only a percentage of failing mail. Use it to ease into quarantine or reject, for example 10 percent, then 50, then 100.
What are rua and ruf?
rua is the address for daily aggregate reports, which most providers send. ruf is for individual failure reports, which many providers do not send because of privacy rules.
Where do I publish the DMARC record?
In your domain's DNS as a TXT record with the host name _dmarc. The tool shows the exact host and value.
Where do I publish the SPF record?
In your domain's DNS as a TXT record on the root of the domain, often shown as @. Publish only one SPF record per domain.
What is the SPF 10 lookup limit?
An SPF check may trigger at most 10 DNS lookups for include, a, mx, ptr, exists and redirect terms. More than 10 causes a permanent error. The tool estimates the count and warns you.
What is the difference between -all and ~all?
-all is a hard fail that tells receivers to reject mail from unlisted servers. ~all is a soft fail that marks it as suspicious. Many senders start with ~all and move to -all.
Why is +all dangerous?
It tells receivers that every server is allowed to send as your domain, which defeats the purpose of SPF.
Can I have two SPF records?
No. Two SPF records on one domain cause a permanent error. Merge them into one record.
How long can an SPF record be?
A single DNS string is limited to 255 characters, and the whole answer should fit in 512 bytes for UDP responses. Long records can be split into several quoted strings or shortened.
How long does it take for DNS changes to work?
Often minutes, sometimes up to the time-to-live of the old record, which can be hours or a day. Test again after that.
Does this tool check my live DNS?
No. It generates and checks the text of a record. Paste your published record into the Check tab to review it.
Sources and further reading
- IETF, RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC).
- IETF, RFC 7208: Sender Policy Framework (SPF).
- IETF, RFC 6376: DKIM Signatures.
- Google, Email sender guidelines.
- Google, Set up DMARC.
- Microsoft, Use DMARC to validate email.
Sources were consulted in October 2026. Standards and rules can change, so always check the official page for your situation.