Skip to main content
Free email tool

SPF and DMARC record generator

Gmail and Yahoo expect bulk senders to authenticate with SPF and DKIM and to publish a DMARC policy. This builder writes the SPF and DMARC TXT records for you; DKIM keys come from your email provider, which publishes or gives you the selector record.

Who sends mail for this domain?

Your DNS records

TXT · Host example.com
v=spf1 include:_spf.google.com ~all
TXT · Host _dmarc.example.com
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

1 of 10 allowed SPF DNS lookups at the top level (nested includes add more).

Publish one SPF record only; replace any existing one rather than adding a second. DKIM keys come from your mail provider. Nothing you type here leaves your browser.

How to use the spf & dmarc record generator

  1. 1Enter your domain. Type the domain you send from, such as example.com.
  2. 2Choose your senders. Tick the services that send mail for the domain so SPF includes them.
  3. 3Pick a DMARC policy. Start at p=none to collect reports, then move to quarantine and reject once every sender passes.
  4. 4Publish in DNS. Copy each host and value into a TXT record at your DNS host, then wait for it to propagate.

Questions

Which DMARC policy should I start with?

Start with p=none and a report address so you can see who sends as your domain without blocking anything. Move to quarantine and then reject once every legitimate sender passes SPF or DKIM alignment.

Can a domain have two SPF records?

No. A domain must publish a single SPF TXT record; two records make SPF fail. Combine every sender into one record, which is what this tool does.

Where do I get my DKIM record?

From the service that sends your mail. Google Workspace, Microsoft 365 and email service providers each generate a DKIM key and tell you the selector host to publish.

Read next

All guides
Deliverability

How to set up SPF, DKIM and DMARC for your domain

SPF, DKIM and DMARC are DNS-based standards that let receiving mail servers check that email claiming to come from your domain is authorised. SPF lists which servers may send for you, DKIM adds a cryptographic signature, and DMARC tells receivers what to do when checks fail and where to send reports. Gmail and Yahoo now require authentication from senders, so this is a baseline, not an optional extra.

8 min read
Deliverability

Gmail and Yahoo bulk sender requirements, explained

Since February 2024, Gmail and Yahoo have required senders to authenticate their mail, and bulk senders must also publish DMARC, support one-click unsubscribe and keep spam complaint rates low. Google describes bulk senders as those sending close to 5,000 or more messages a day to Gmail addresses. Google also advises keeping the reported spam rate below 0.1 percent and never reaching 0.3 percent.

7 min read
Deliverability

The email deliverability metrics worth tracking

The deliverability metrics that matter most are bounce rate, spam complaint rate, inbox placement, authentication pass rate and genuine engagement such as replies and clicks. Delivery rate alone only tells you that a server accepted the message, not whether it reached the inbox. Tracking these together shows how mailbox providers see your sending.

6 min read

Other free email tools

Email Spam Word Checker

Check a subject line and body for spammy phrasing, shouting and link overload.

Open free tool
Email Automate for Chrome

Automate the mailboxes you own, right inside Chrome.

Runs in the Gmail, Outlook, Yahoo, AOL and Proton tabs you are already signed in to. Filter by sender or campaign, set reading times and limits, keep a local activity log. No mailbox passwords, one-time licence.

More on ALTFTool