Email DNS · SPF · DMARC · DKIM

Generate SPF and DMARC records safely

Create publish-ready TXT record text for common mail authentication policies, review pasted SPF, DMARC, and DKIM records, then export the exact DNS values and deployment checklist without a fake deliverability score.

MODELOCAL BUILDEROUTPUTSCSV + ZONE + JSONPROOFVERIFY AFTER DNS

DOMAIN AND TTL

Set the DNS hostnames that will receive TXT records

Use the organizational domain that appears in sender addresses. Subdomain and provider-specific mail streams should be drafted and tested separately.

Sending domainTTL seconds

SPF BUILDER

Authorize the mail sources you actually use

Add MX, A, include, and IP mechanisms deliberately. OpenWebmaster counts DNS-lookup mechanisms and keeps broad sender policies visible for review.

mx Allow current MX hosts to senda Allow the domain address recordInclude domainsIPv4 sendersIPv6 sendersAdvanced SPF termsDefault all mechanismRedirect domain

DMARC BUILDER

Publish alignment policy and reporting destinations

Start with monitoring if the domain has never received reports. Move toward quarantine or reject only after authorized senders are aligned.

Domain policySubdomain policyPolicy percentageAggregate reports (rua)Forensic reports (ruf)DKIM alignmentSPF alignmentFailure optionsReport interval

OPTIONAL DKIM TXT

Generate a selector record when you already have the public key

DKIM private keys belong in the sending platform, not in this tool. Paste only a public key if you want DNS record text.

SelectorPublic key

PASTED POLICY REVIEW

Lint existing SPF, DMARC, or DKIM records before changing DNS

Paste exported TXT records or zone snippets. The checker reviews visible policy syntax and does not query live DNS from this builder.

Existing TXT records 0 / 20,000 characters

Boundary: this creates and reviews DNS TXT policy text. Verify live publication afterward with DNS inspection and real mail-header tests.

TXT

Ready for your mail policy.

No sample inbox result, deliverability score, spam-folder prediction, DNS propagation claim, ranking impact, or manufactured email grade appears before you build from supplied settings.

DEPLOYMENT PRACTICE

Treat email authentication as staged infrastructure

Start from known senders

List every platform that sends as the domain before tightening SPF or DMARC. Missing providers cause real mail to fail authentication.

Use reports before enforcement

DMARC aggregate reports show which streams align. They are the safest way to move from monitoring toward quarantine or reject.

Verify after the TTL

DNS changes are cached. Save the exported records, wait for the old TTL to pass, then inspect live DNS and real message headers.