All tools
SPF & DMARC Generator
Answer a few questions below to generate the exact DNS syntax for your SPF and DMARC records. Authentication is what stops your domain being spoofed and what gets you past the bulk sender requirements — it is necessary for inbox placement, and it is not sufficient on its own.
SPF Record Generator
Configure exactly who is allowed to send email from your domain.
v=spf1 include:_spf.google.com ~all
How to use: Create a new TXT record in your DNS settings. Set the Name/Host to @ (or leave blank), and paste the generated string into the Value field.
DMARC Record Generator
Protect your domain from spoofing and phishing.
Reports arrive here as daily XML attachments — use a dedicated address, not your main inbox.
Enter your domain above to auto-fill the reporting address.
If no mail is ever sent from subdomains you haven't set up, set this to reject. It closes a spoofing route attackers actively use.
Enter your domain to generate a DMARC record with a reporting address.
How to use: Create a new TXT record in your DNS settings. Set the Name/Host to _dmarc, and paste the generated string into the Value field.
Frequently Asked Questions
Why should I use a Soft Fail (~all) instead of Hard Fail (-all) for SPF?
A soft fail (~all) tells the receiving server to accept the email but mark it as suspicious if it fails SPF. A hard fail (-all) tells the server to completely reject the email. In modern email infrastructure, emails are frequently forwarded (e.g., from an alumni address to a Gmail address). Forwarding often breaks SPF. If you use a hard fail, legitimate forwarded emails will bounce. It is best practice to use ~all and rely on DMARC for actual enforcement.
Why should I start with a p=none DMARC policy?
If you jump straight to p=reject, you risk blocking your own legitimate emails if you forgot to authenticate a tool (like your helpdesk, CRM, or billing software). Setting your policy to p=none allows you to receive DMARC XML reports for a few weeks to monitor your traffic and identify all your sending sources before you flip the switch to enforcement.
Can I have multiple SPF records?
No. You can only have one SPF TXT record on your domain. If you use multiple services (like Google Workspace and Mailchimp), you must combine them into a single record using multiple include: statements. Our generator handles this combination for you automatically.
Deploy these records safely
Changing your DNS records without a rollout plan can bounce your own emails. Get the exact step-by-step system.
Get the Playbook