Email SPF, DKIM & DMARC Generator

Build and validate DNS TXT records to prevent email spoofing, protect domain reputation, and pass strict DMARC checks.

Generated SPF DNS TXT Record (Host: @)
v=spf1 mx include:_spf.google.com ~all
Character count: 38 / 255 max per string

The Complete Email Authentication Trio: SPF, DKIM, and DMARC

In 2024, Google and Yahoo introduced mandatory authentication requirements for all bulk email senders. Without properly configured SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) records, marketing newsletters, transactional receipts, and password reset emails will be rejected or relegated to spam folders.

How the Three Protocols Work Together

  • SPF (Sender Policy Framework): A DNS TXT record placed on your root domain (@) listing the authorized IP addresses and third-party SaaS services (like SendGrid, Google, or Postmark) permitted to send emails claiming to originate from your domain.
  • DKIM (DomainKeys Identified Mail): Uses asymmetric public/private key cryptography to digitally sign outgoing email headers. The receiving mail server retrieves your public key from DNS (selector._domainkey.domain.com) to verify that the message body was not tampered with in transit.
  • DMARC Policy: Tells recipient servers what action to take if SPF or DKIM fails (p=none for logging, p=quarantine for spam folder, or p=reject to bounce the email) and sends XML diagnostic reports to your rua= mailbox.

Common SPF Pitfalls to Avoid

The DNS SPF specification (RFC 7208) limits SPF evaluations to a maximum of 10 DNS lookups per check. Never publish multiple SPF records on a single domain—combine all your sending providers into one unified v=spf1 ... string.