SPF & DMARC record generator
Pick the services that send email for you and get ready-to-paste DNS TXT records. Everything runs in your browser; nothing is sent anywhere.
3. Records to add to DNS
How to add the records
- Cloudflare: select the domain → DNS → Records → Add record → Type
TXT, Name@(SPF) or_dmarc(DMARC), paste the value → Save. - Other registrars/DNS hosts: open DNS management, add a TXT record with the Host and Value above. Some panels use
@for the root, others leave it blank or want the full domain. - If you already have an SPF record, edit it instead of adding a new one.
- DNS changes can take from a few minutes to a few hours to propagate. Then use the check button below.
What do SPF and DMARC do?
Without SPF and DMARC, anyone can send email as billing@yourcompany.com to trick your customers. SPF says which servers may send; DMARC tells Gmail and Outlook to block or spam-folder mail that fails, and sends you reports.
Since 2024 Gmail and Yahoo require bulk senders to have SPF, DKIM and DMARC; without them, even your real email is more likely to land in spam.
FAQ
Can I add two SPF records?
No. A domain may have only one TXT record starting with v=spf1. Two records make SPF fail. Merge all includes into a single record.
Should I use ~all or -all?
Start with ~all so real email isn't lost if you forgot a sender. Once DMARC reports show every legitimate source passes SPF, you can switch to -all.
Which DMARC policy should I use?
Start with p=none plus rua to collect reports for 2–4 weeks. When legitimate mail passes, move to p=quarantine and then p=reject to block spoofed mail.
Can this tool generate DKIM?
No. The DKIM key is created by your email provider. Turn on DKIM in your provider's admin console and add the DNS record they give you.
Run a free full website security scan
Beyond SPF/DMARC, WebsiteScanner checks SSL, security headers, exposed files and signs of hacking, with an A–F grade and fixes.