Free SPF and DMARC Record Generator

Your domain

Records go on your registrable domain, not on www.

Domain Enter a domain like yourcompany.com

Who sends email as you?

Select every service that sends mail using your domain, including invoicing, ticketing and marketing tools, which are the ones usually forgotten.

Additional include: values Comma separated. Each one costs a DNS lookup.

Additional sending IP addresses Comma separated. These cost no lookups, so prefer them where the address is stable.

Treatment of everyone else

Use ~all while you are still finding senders, then tighten to -all.

DMARC policy

Policy

Reporting address Aggregate reports go here. Without one, DMARC gives you no visibility. Enter a valid email address

Apply to what share of mail? Below 100 lets you phase in quarantine or reject gradually.

Strict alignmentRequires an exact domain match rather than allowing subdomains. Leave off unless you know you need it.

CAA record (optional)

Not email authentication, but the same kind of one-line DNS policy, it restricts which certificate authorities may issue for your domain.

Your certificate authority

Your records

Publish each of these as a DNS record at the name shown.

SPF lookups used

0 of 10

Questions people ask about this

What does this SPF generator do?

It assembles a valid SPF record from the mail services you select, counts the DNS lookups that record will cost against the limit of ten, and warns you before you publish something that will fail evaluation. It also generates a matching DMARC record and an optional CAA record.

Why does the ten-lookup limit matter?

SPF evaluation is capped at ten DNS lookups. Every include, a, mx and redirect mechanism counts, and includes are recursive, so a single provider can consume several. Exceeding the limit produces a permerror, which many receiving servers treat as a failure - so the record exists, looks correct, and does not work.

Which DMARC policy should I start with?

Start with p=none and a reporting address. That gives you visibility into every system sending as your domain without affecting delivery. Once the reports show only senders you recognise and have authorised, move to quarantine, then to reject.

Is anything I type here sent to Trufend?

No. The entire tool runs in your browser. The records are assembled locally in JavaScript and nothing is transmitted, logged or stored on a server.