01What are these records for?
SPF lists the servers allowed to send email on behalf of your domain; DMARC tells mailbox providers what to do with messages that fail verification (nothing, spam, reject) and where to send reports. Without them, your email lands in spam and anyone can spoof your domain — Gmail and Yahoo have required them since 2024.
This generator builds records that are correct by construction: a single SPF, a single trailing all, valid DMARC syntax. Once published in your DNS zone, verify the result with our email check — it also analyzes DKIM, the third building block, whose key is provided by your sending provider.
02Understanding each field
- include:
- Delegates to your provider's SPF list: it automatically follows their infrastructure changes. Each include counts against the 10 DNS lookup limit.
- ip4: / ip6:
- Allows a fixed address (your dedicated sending server). Does not count against the 10 lookup limit: prefer it when the IP is stable.
- ~all / -all
- The fate of unlisted servers: ~all marks them suspicious (softfail), -all rejects them. Start with ~all, move to -all once everything is aligned.
- p=
- The DMARC policy: none (observe), quarantine (spam), reject. Real protection starts at quarantine.
- rua=
- The address receiving the providers' daily aggregate reports: essential to know who sends in your name before hardening the policy.
- pct= / sp=
- pct applies the policy to a percentage of messages (progressive rollout); sp sets a separate policy for subdomains.
03How do I publish these records?
In your registrar's or host's DNS interface (Cloudflare, Gandi, GoDaddy…), create two TXT records: the first on host @ (the domain root) with the SPF value, the second on host _dmarc with the DMARC value. If an SPF already exists, replace it — two SPF records make the configuration invalid.
Propagation follows your zone's TTL (see our propagation checker). Publish DMARC at p=none first with a rua address, analyze the reports for a few weeks, align all your legitimate senders, then harden to quarantine and reject.
04Frequently asked questions
I already have an SPF record: can I add a second one?
No: RFC 7208 mandates a single SPF record per domain, otherwise servers may reject all of them (permerror). Merge the mechanisms into one record: take your existing includes, tick them here along with your new providers, and replace the old record with the result.
What address should I put in rua?
A mailbox you actually read or, better, a DMARC analysis service (reports are daily XML files, hard to read by hand). The address may be on another domain — providers then verify that this domain accepts reports for yours through an authorization record.
What about DKIM — doesn't this generator produce it?
No, deliberately: the DKIM key is a cryptographic pair generated by your sending provider (Google Workspace, Microsoft 365, Brevo…). Enable DKIM in their interface and they will give you the exact record (selector + public key) to publish. Then verify it with our email check.
How long should I stay at p=none?
Long enough to analyze the rua reports: two to six weeks is usually enough to spot all your legitimate sending flows (CRM, billing, newsletters…) and align them. Staying at p=none forever is the most common mistake: it is an observation policy, not a protection.
Does the generator guarantee my email will be delivered?
It guarantees syntactically correct records, not deliverability: that also depends on DKIM, domain alignment, your IPs' reputation and your messages' content. SPF and DMARC are the prerequisite — the foundation without which the rest doesn't count.