SPF & DMARC Record Builder
Builds valid SPF and DMARC TXT records from a guided form and explains each mechanism it emits.
Builds SPF, DMARC and DKIM records with the two mistakes that swallow most mail designed out: the SPF lookup count is a live number beside the includes rather than a warning afterwards, and a DMARC reject with no reporting address is refused rather than emitted. Every record is explained back tag by tag.
Your own servers
Free — these cost no DNS lookups at all.
Services that send on your behalf
about 5 of 10 lookupsEverything else
Softfail marks unlisted senders as suspicious without rejecting them. It is the right setting while you are still finding out who sends as you.
Type
TXT
Name / host
example.com
Value
v=spf1 mx include:_spf.google.com ~all
38 characters
Where the lookups go
| Mechanism | Lookups |
|---|---|
| mx | 1 |
| include:_spf.google.com | 1 + 3 inside |
Nested counts are estimates from what these providers publish today and can change without notice. The only way to know the real total is to expand every include at the time you publish.
Records are assembled and validated in this page. Nothing is published, nothing is queried, and the domain you are configuring is not disclosed to anyone by using this tool.
How to use it
List every service that sends as you
The mail provider, the newsletter tool, the helpdesk, the invoicing system. The last one is the one nobody remembers and the one that breaks when you tighten the policy.
Watch the lookup count as you add them
SPF allows ten DNS lookups and each include costs at least one, often several once expanded. Exceeding it is a permanent error, which most receivers treat as having no SPF at all — a silent, total failure.
Start DMARC at p=none with a report address
Nothing is blocked, and the daily reports tell you who sends as your domain. Move to quarantine, then reject, once the reports show nothing legitimate failing — and use the percentage slider to roll it out gradually.
Publish it as a TXT record
The name and value are given exactly as your DNS provider wants them. DMARC goes at _dmarc, DKIM at the selector, SPF at the domain itself — and a domain may hold only one SPF record.
Common questions
Is anything published or looked up?
Neither. Records are assembled and checked in this page. The domain you are configuring is not disclosed to anyone by using this tool, which is worth something when the record is for a domain that is not live yet.
Can I have two SPF records?
No. Two SPF records is a permanent error and behaves like having none. Merge the includes into one record — and check the lookup count afterwards, because merging is how domains cross the limit.
Are the nested lookup counts exact?
No, they are estimates from what each provider publishes today, and a provider can change theirs without telling anyone. The only exact answer is to expand every include at the moment you publish.
Should I turn on strict alignment?
Usually not. Strict alignment breaks anything sending from a subdomain — mailing lists, ticketing systems, most "send as" integrations. Relaxed is the default for good reason.
The checker says nothing is wrong but mail still fails
This checks the record’s syntax and its lookup budget. It cannot tell you whether the senders it lists are the ones actually sending your mail — only the aggregate reports at your rua address do that.
Feed it from
Mail Deliverability Check
Checks a domain’s MX, SPF, DKIM and DMARC records together and explains why mail would be rejected.
Sent vs Delivered Comparison
Send a draft to a disposable address from your own account and see what the sending path rewrote — links wrapped in redirects, dropped style blocks, added beacons, the encoding used.
Next
These accept what this tool produces, so the result can go straight in.
DNS Lookup
Queries A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA and PTR records over DoH, with TTL and the DNSSEC bit shown, from Cloudflare or Google.
Email Header Analyser
Parses raw email headers into a delivery timeline with per-hop delays, reads the receiving server’s SPF, DKIM and DMARC verdicts, and flags From/Reply-To/Return-Path mismatches.
Mail Deliverability Check
Checks a domain’s MX, SPF, DKIM and DMARC records together and explains why mail would be rejected.
HTTP Request Builder
Composes and sends a GET/POST/PUT/PATCH/DELETE/HEAD request with custom headers and a body, and shows the status, headers, body and timing — without ever forwarding cookies or Authorization.
HTTP Header Inspector
Fetches a URL and shows the full response headers, redirect chain, timings and compression used.
IP Address Info
Shows your public IP or any address with its reverse name, ASN, announcing network, prefix and registry country from Team Cymru’s DNS data — no city-level geolocation.