Free tool
SPF and DMARC record generator
Build the DNS records for a new sending domain or subdomain, check the ones you already have, and see what each setting means. It runs in your browser. Nothing you type is sent anywhere.
Generate your records
Used only in your browser to build host names. Nothing is sent anywhere.
Enter your domain above to generate a record.
Enter your domain above to generate a record.
Check an existing record
Quotes, split strings and a zone-file line such as example.com. IN TXT "v=spf1 …" are fine. The check runs in your browser and never follows includes. The domain above is used to spot external DMARC report addresses.
The three records
What SPF, DKIM and DMARC each do
Three checks, three DNS records. A receiving server runs them when your mail arrives.
SPF
A TXT record listing the servers allowed to send for a domain. It is checked against the envelope sender, and it ends with an all-qualifier that says what to do with everyone else.
DKIM
A signature added to each message, verified with a public key published in DNS. The keys come from your sending provider, not from this page. With SendRaven, the DKIM records for a domain are in the dns_records of the domains API response; publish what it returns.
DMARC
A policy that ties the other two to the domain in your From address, says what to do when neither lines up, and asks receivers to send you reports.
Publish SPF and DKIM first, then DMARC. DMARC passes when SPF or DKIM passes and aligns with the From domain, so a domain with neither in place has nothing for the policy to rest on. The deliverability page explains how SendRaven separates sending identities.
Before you publish
Common mistakes
Two SPF records on one host name
A name may have exactly one TXT record starting with v=spf1. Add a second and receivers return a permanent error. Merge the senders into one record.
More than 10 DNS lookups
include, a, mx, ptr, exists and redirect each cost a lookup, and the includes inside an include count too. Past 10, SPF fails. Swap includes you no longer use for ip4 and ip6 ranges.
+all, ?all or ptr
+all authorizes the whole internet. ?all says nothing about unlisted servers. ptr is deprecated and slow. Use ~all while you check your senders, then -all if you want a firm answer.
Forgetting a sender
The billing tool, the CRM, the support desk. Each one sends mail as your domain, and each needs SPF or DKIM that aligns with it before a strict policy is safe.
Jumping straight to p=reject
A policy on a domain you have not read reports for can turn away your own mail. Start at p=none with a rua address, read what arrives, then tighten.
Reports that go nowhere
A rua address nobody reads is the same as no rua. And a report address on another domain needs that domain to publish an authorization record, or receivers skip it.
Checking the wrong domain for SPF
SPF is evaluated against the envelope sender (the Return-Path), which a provider often sets to its own bounce subdomain, not the From domain. DMARC passes when SPF or DKIM aligns with the From domain.
Pasting a long record as one string
A single TXT string holds 255 characters. Longer records go in as several quoted strings in the same record. The generator splits them for you.
After the records
Warming up a new domain
Records prove you are allowed to send. They do not give a domain a history. Mailbox providers judge a new domain on how it behaves, so start with a small amount of mail to people who expect it, raise the volume in steps, and watch bounces and complaints before each step.
On a separate marketing subdomain, a slow start protects that subdomain’s reputation without touching the transactional one. SendRaven also caps marketing volume on a new sending identity for its first fortnight. The long version, including the twenty-nine minutes that taught us why, is in how to warm up a new sending domain.
FAQ
Questions about SPF and DMARC
What is an SPF record?
An SPF record is a DNS TXT record that lists the servers allowed to send mail for a domain. A receiving server compares the sending server against that list and reads the all-qualifier at the end to decide how to treat everything not on it.
How many DNS lookups can an SPF record have?
Ten. Each include, a, mx, ptr, exists and redirect counts, and so does every lookup inside the records an include points to. This tool cannot follow includes offline, so it counts what is in your record and gives a labeled estimate for the rest; check the real total with a lookup tool that follows includes.
Do I need SPF, DKIM and DMARC all together?
Yes, they do different jobs. SPF lists permitted servers, DKIM signs each message with a key from your sending provider, and DMARC tells receivers what to do when neither lines up with the From domain, and where to send reports.
Should I start DMARC at p=none?
For a domain you have not read reports for, yes. p=none asks receivers to take no action and send you aggregate reports, which show who is sending as your domain. Move to quarantine and then reject when the reports look the way you expect. Receivers decide how they act, so results vary.
Does a DMARC record cover subdomains?
Yes, by default. A subdomain without a _dmarc record of its own falls back to the parent domain's record, and the sp tag sets a different policy for subdomains. A _dmarc record on the subdomain itself takes precedence for that name.
Why separate transactional and marketing subdomains?
Mailbox providers score reputation per sending domain, so separate subdomains keep a campaign's complaints from touching password resets. Each subdomain publishes its own SPF, DKIM and DMARC records, which is what the toggle in the generator builds.
Does this tool send my domain or records anywhere?
No. The generator and validator run in your browser and make no network requests with what you type. Nothing is stored or uploaded.
Next step
Set up a sending domain in SendRaven: free for 3,000 emails a month, unlimited contacts
Add a domain and get the exact DNS records to publish.