SPF and DMARC Generator

Your domain (optional, only used to label the record)

SPF

Check the services that send mail on behalf of your domain. Each one adds a DNS lookup to the SPF budget.

Google WorkspaceMicrosoft 365SendGridMailgunAmazon SES

Additional mechanisms (one per line, e.g. include:_spf.otherservice.com or ip4:203.0.113.5)

What to do with mail that doesn't match

~all-all

soft fail — flagged as suspicious but usually still delivered. Recommended while you verify your provider list is complete.

TXT record for the root domain

v=spf1 ~all

DNS lookups used: 0 of 10

DMARC

Roll out DMARC in stages: start at "none" with a reports email (rua) for a few weeks to see what would get rejected, and only then move to "quarantine" and finally "reject". Publishing "reject" from day one can make you stop receiving your own mail if something isn't configured right.

Policy

nonequarantinereject

none — observe only (recommended to start)

Email to receive reports (rua)

Without a reports email, "none" is pointless — nobody sees what would be failing.

Percentage of mail affected (pct)

TXT record for _dmarc.yourdomain.com

v=DMARC1; p=none;

DKIM

The DKIM record isn't generated here: your email provider (Google Workspace, Microsoft 365, SendGrid...) issues it, because it has to match the private key it signs your mail with. A record invented on this page wouldn't be signed by anyone and would be useless. Copy the TXT record your provider gives you and add it to your DNS alongside these two.

SPF and DMARC generator

SPF

DMARC

DKIM

What about the rest of your domain?