Free Developer Tool

SPF, DKIM & DMARC Record Generator

Generate accurate DNS TXT records for your domain to satisfy Gmail, Yahoo, and Outlook 2026 sender guidelines. Prevent spoofing and ensure 100% inbox placement.

Domain Settings

Your Sending Domain:

DKIM Selector:

DMARC Policy:

DMARC Aggregate Reports Email (RUA):

Generated DNS TXT Records

1. SPF Record

Host / Name: @ or yourdomain.com

v=spf1 include:sendporter.com ~all

2. DKIM Record

Host / Name: sp._domainkey.yourdomain.com

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3SendPorterGeneratedKey...

3. DMARC Record

Host / Name: _dmarc.yourdomain.com

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100; sp=none;

DNS Authentication Guide: SPF, DKIM & DMARC

Properly configuring DNS records is the single most critical factor in guaranteeing that your transactional emails land in user inboxes rather than spam folders. Mailbox providers like Google, Yahoo, and Microsoft use these three protocols together to verify sender identity and block phishing.

1. SPF: Sender Policy Framework (RFC 7208)

SPF tells receiving mail servers which IP addresses or mail providers are authorized to send messages on behalf of your domain.

Only one SPF record allowed: Publishing multiple SPF TXT records on the root domain is invalid under RFC 7208 and causes all SPF checks to fail. Always merge multiple providers into a single v=spf1 ... ~all record.
The 10-lookup ceiling: An SPF record cannot trigger more than 10 DNS lookups (from include, a, mx, or redirect modifiers). Exceeding 10 results in a PermError.

2. DKIM: DomainKeys Identified Mail (RFC 6376)

DKIM adds a tamper-proof cryptographic signature to each outgoing email. The receiving MTA fetches your public key from DNS to verify authenticity.

2048-bit RSA keys: While 1024-bit keys were standard in past years, modern providers require 2048-bit keys for long-term cryptographic security.
Selectors: The selector (e.g. sp) allows you to run multiple sending services simultaneously without key collision.

3. DMARC: Policy and Alignment (RFC 7489)

DMARC specifies what recipient servers should do if an email fails both SPF and DKIM authentication.

p=none (Monitoring): Logs authentication results without affecting email delivery. Recommended when first deploying.
p=quarantine: Moves unauthenticated messages to the recipient's spam folder.
p=reject: Completely blocks unauthenticated messages from delivery, preventing domain spoofing.

Common DNS Configuration Mistakes

❌ Including quotes in Cloudflare or Route 53:

Most modern DNS dashboards automatically add quotes around TXT records. If you type literal quotation marks, the record becomes doubly quoted (e.g., "\"v=spf1...\""), which fails DNS validation.

❌ Repeating your domain name in the Host field:

When creating a DMARC record, most DNS panels append your domain name automatically. Entering _dmarc.yourdomain.com in the name field can create _dmarc.yourdomain.com.yourdomain.com. Enter only _dmarc.

❌ Using +all in SPF:

Using +all tells the entire internet that any server on earth is allowed to send emails from your domain. Always use ~all (soft fail) or -all (hard fail).

Frequently Asked Questions

How long does DNS record propagation take?

On modern DNS providers like Cloudflare and Route 53, TXT record changes usually propagate within 2 to 5 minutes. Some registrars with long TTL settings can take up to 24 hours.

How do I test if my DNS records are working?

Run dig txt yourdomain.com +short and dig txt _dmarc.yourdomain.com +short in your terminal. You should see your SPF and DMARC TXT record strings returned.

Automate your domain authentication with SendPorter

Connect your domain to SendPorter and we'll automatically verify and monitor your DNS authentication health.

Request access