Micro Tools
Advertisement

DNS Record Generator

Build SPF, DKIM and DMARC DNS record syntax from guided inputs: mechanisms, selectors, policies and report addresses. Copy the finished TXT records to your DNS host. A syntax builder, not a live DNS lookup.

DNS record builder

Syntax builder only. It does not query live DNS. Publish the records at your DNS host, then verify with dig or a DNS checker.

SPF record

Host: @   Type: TXT

v=spf1

DKIM record

Host: selector1._domainkey   Type: TXT

v=DKIM1; k=rsa; p=

DMARC record

Host: _dmarc.example.com   Type: TXT

v=DMARC1;
Advertisement

SPF, DKIM and DMARC in brief

Email authentication rests on three DNS TXT records. SPF lists which servers may send mail for your domain, DKIM publishes the public key that verifies message signatures, and DMARC tells receivers what to do when checks fail and where to send reports. This builder assembles the exact record syntax from your choices.

Builder, not a lookup

This is a syntax builder, not a live DNS lookup: it cannot see your current records or publish anything. After generating a record, add it as a TXT record at your DNS host, then verify propagation with dig or an online checker before enforcing a strict DMARC policy like p=reject.

Related tools

JSON formatterFormat and validate JSON, privately. Regex testerTest regex live with highlighting. Base64 encoderBase64 encode and decode, plus URL encoder and JWT decoder.

DNS Record Generator FAQs

What is the difference between SPF, DKIM and DMARC?
SPF authorizes sending servers by IP or domain, DKIM proves a message was not altered in transit using public-key signatures, and DMARC ties them together with a policy for failures plus reporting. You need all three for strong deliverability.
How do I write an SPF record?
Roughly: v=spf1 lists mechanisms (a, mx, ip4, include) and ends with an all rule. -all means hard fail (reject others), ~all means soft fail (accept but mark), and ?all means neutral. Start with ~all while testing.
What is a DKIM selector?
The selector (often selector1 or a date like 202401) picks which key signs mail, letting you rotate keys. It becomes the left side of the TXT record: selector1._domainkey. Your mail provider usually tells you which selector to use.
Which DMARC policy should I start with?
p=none only reports, p=quarantine sends failures to spam, and p=reject blocks them outright. Move none to quarantine to reject gradually while watching the rua reports for legitimate mail being flagged.
Does this tool change my DNS?
No. It only builds record text from your inputs and never queries DNS, so it cannot read, change or publish anything. Publishing happens at your DNS host.
Advertisement