Skip to main content
MyIPKit— Your network, explained.

SPF and DMARC record generator

Build the two records that stop others sending mail as your domain, from choices rather than syntax — including the two-line lock-down for a domain that sends no mail at all.

Runs entirely in your browser — nothing is sent anywhere

Optional. Used to name the records and to check report addresses.

SPF — who may send

Services that send mail as this domain

Confirm each value in the provider’s own setup guide before publishing; providers occasionally change them.

One per line, for example mail.example.net.

IPv4 or IPv6 addresses or blocks, one per line.

This domain’s own servers send mail

Untick to use ~all while you are still finding every sender.

DMARC — what receivers do with forgeries

Email addresses, one per line. Optional, but reports show who sends as you.

Strict alignment

Records to publish

Runs entirely in your browser — nothing is sent anywhere

The order that avoids breaking mail

  • Publish SPF listing every service that sends as you, ending in ~all.
  • Set up DKIM with each of those services.
  • Publish DMARC with p=none and a report address, and read the reports for a few weeks.
  • Move SPF to -all and DMARC to quarantine, then reject.

After publishing, the SPF, DKIM and DMARC check confirms what receivers will see.

Where do these records go?

At your DNS host, as TXT records: SPF on the domain itself (name “@” in most control panels) and DMARC on the name “_dmarc”.

What about DKIM?

DKIM keys are generated by each sending service, which gives you the exact record to publish. There is nothing to build: copy what the service shows you.

Should I start with p=reject?

Only for a domain that sends no mail. Otherwise start with p=none and a report address, read the reports for a few weeks, then tighten — reports show senders you forgot.

Can I have two SPF records?

No. Two records starting with v=spf1 make SPF fail entirely. Combine them into one — which is what this generator produces.