Email Authentication Studio: SPF, DKIM & DMARC Generator (3-in-1)
Generate all three email-authentication DNS records in one sitting. Build an SPF record from verified provider presets with a live 10-lookup-limit simulator (RFC 7208), generate a real DKIM RSA key pair in your browser and get the exact DNS TXT record, and assemble a DMARC policy that is DMARCbis (RFC 9989) aware. 100% client-side — your domain, selectors, and private keys never leave this page.
SPF record builder
Tick your sending providers, add IPs if you self-host, choose the ending. The record, its validation, and the lookup simulation update live.
include:123456.spf05.hubspotemail.net) — there is no single static value. Copy yours from HubSpot → Settings → Domains & URLs → Connect a domain, and paste it into “Custom includes” below.DNS lookup simulator — RFC 7208 §10.1
Validate an existing SPF record
DKIM key-pair generator (real RSA, in-browser)
Provider selector reference
Validate an existing DKIM record
DMARC record builder (RFC 9989 / DMARCbis aware)
Rollout ladder: none → quarantine → reject
Validate an existing DMARC record
How SPF, DKIM, and DMARC work together
Think of the trio as three independent witnesses for every email:
- SPF answers “is this server allowed to send for this domain?” — the receiver checks the connecting IP against the domain's SPF record (the envelope-from domain).
- DKIM answers “is this message intact and from who it claims?” — a cryptographic signature, verifiable with the public key in DNS, survives forwarding (which is where SPF usually breaks).
- DMARC answers “do these identities match the visible From: address, and what should I do if not?” — this alignment requirement is the crucial part: SPF can pass on the envelope domain while the From: header shows your domain, and DMARC still fails it.
A message passes DMARC when either SPF or DKIM passes and aligns with the From: domain. That is why you want both SPF and DKIM deployed before enforcing a DMARC policy — and why the rollout ladder above (none → quarantine → reject) exists.
The SPF 10-lookup limit, explained
RFC 7208 §10.1 caps SPF evaluation at 10 DNS-querying mechanisms and modifiers: include, a, mx, ptr, exists, and the redirect modifier. ip4, ip6, and all are free. The limit bounds the work receivers must do and blunts DNS-based denial-of-service. Exceed it and receivers return PermError — SPF fails.
The trap: include mechanisms recurse. include:_spf.google.com costs 1 lookup itself plus 3 nested (Google's _netblocks, _netblocks2, _netblocks3) = 4 total. Two such providers plus an mx and you are at 9 before you add anything custom. The simulator above counts your record — including documented provider nesting — before you publish.
Common fixes when you are over: drop providers you no longer use, replace an include with the provider's published IP ranges (SPF flattening), or move marketing mail to a subdomain with its own record.
SPF setup guides by provider
Each guide assumes you merge the provider's include into your single SPF record (never publish two). Publish as a TXT record at your root domain (@).
Google Workspace / Gmail
v=spf1 include:_spf.google.com ~all
Google's include costs 4 lookups (1 + 3 nested). Source: Google Workspace Admin Help, “Set up SPF”. Verified Oct 2026.
Microsoft 365 / Outlook / Exchange Online
v=spf1 include:spf.protection.outlook.com ~all
Microsoft's include costs 4 lookups (1 + 3 nested: spf-a/b/c). Source: Microsoft Learn, “Set up SPF”. Verified Oct 2026.
Zoho Mail
v=spf1 include:zoho.com ~all
Source: Zoho Mail help docs / community (help.zoho.com). Verified Oct 2026.
SendGrid
v=spf1 include:sendgrid.net ~all
Mailgun
v=spf1 include:mailgun.org ~all
Amazon SES
v=spf1 include:amazonses.com ~all
Mailchimp
v=spf1 include:servers.mcsv.net ~all
Combining providers (example: Google + SendGrid)
v=spf1 include:_spf.google.com include:sendgrid.net ~all
That record costs 4 + 1 = 5 lookups — paste it in the validator above to confirm. Provider include values change occasionally; when in doubt, copy the current value from your provider's official documentation.
Adding the records at your DNS host
- Cloudflare: DNS → Add record → TXT. Name
@for SPF,selector._domainkeyfor DKIM,_dmarcfor DMARC. Cloudflare auto-splits long TXT values. - GoDaddy: DNS → Add → TXT. Host
@/selector._domainkey/_dmarc. Paste the value; GoDaddy handles 255-char chunking. - Namecheap: Advanced DNS → Add new record → TXT. Host
@,selector._domainkey,_dmarc. - cPanel: Zone Editor → Manage → Add Record → TXT. Name is the full hostname (e.g.
_dmarc.yourdomain.com.). - Hostinger: DNS / Nameservers → Manage DNS records → Add TXT record.
Set a low TTL (300s) while rolling out so mistakes are quick to fix, then raise it.
DMARCbis (RFC 9989): what actually changed
In May 2026, DMARC became a real IETF Standards Track protocol: RFC 9989 (core), RFC 9990 (aggregate reports), RFC 9991 (failure reports) — replacing the informational RFC 7489 from 2015. What changes for your records:
pctis gone. Receivers implemented the percentage dial so inconsistently that it was unremovable ambiguity — it is now removed from the spec. A binaryttag replaces its only sane use:t=yannounces your policy while receivers apply it one level milder (reject→quarantine, quarantine→none). Receivers on old code ignoret=and enforce fully, so it is not a universal safety net.npis new. It sets the policy for mail claiming a subdomain that does not exist in DNS at all (NXDOMAIN) — a cheap, popular spoofing route you can now close withnp=rejecteven while the main policy is stillp=none. (sp=continues to cover subdomains that do exist.)riandrfare gone — receivers ignore them; report cadence and formats live in RFC 9990/9991 now.- No more Public Suffix List — receivers find your organizational domain with a DNS tree walk instead.
- What did not change:
v=DMARC1, thep/sp/adkim/aspf/rua/ruf/fotags, and the alignment model. Existing records keep validating.
The DMARC builder on this page defaults to the RFC 9989 model: no pct, optional np, optional t — and it warns you if you paste a legacy record containing removed tags.
Troubleshooting
“SPF record not working” / PermError
The top causes in order: two SPF records (merge into one), over 10 lookups (count with the simulator), a typo in an include domain, or checking too soon after a DNS change (wait out the TTL).
“DKIM selector not found”
Usually the TXT went to the wrong name (selector._domainkey must be exact), the value was truncated by the DNS editor (use the pre-split version), or propagation has not finished. Also confirm your signer is actually signing — a published key with no signatures changes nothing.
“DMARC reports not arriving”
rua= must be a valid mailto: address that exists and can receive mail; some providers require you to authorize external report destinations. Aggregate reports arrive roughly daily — not instantly.
“DMARC fails even though SPF passes”
Almost always alignment: SPF passed on the envelope-from (e.g. your provider's bounce domain) while the visible From: is your domain. Fix by aligning the envelope domain or — more robustly — getting DKIM signing working, since DKIM's d= typically matches your From: domain directly.
Comparison: this studio vs single-purpose generators
| This studio | PowerDMARC / EasyDMARC | MXToolbox | dmarcgenerator.com & co. | nyverio.com SPF tool | |
|---|---|---|---|---|---|
| SPF + DKIM + DMARC in one page | ✓ | separate tools | separate tools | DMARC only | SPF only |
| 100% client-side, no signup | ✓ | account funnel | ✓ (tools free) | ✓ | ✓ |
| SPF 10-lookup simulator | ✓ (with provider nesting) | checker separate | checker separate | — | ✓ (basic) |
| Real in-browser DKIM keygen | ✓ (WebCrypto RSA) | ✓ | ✓ | — | — |
| DMARCbis (RFC 9989) aware | ✓ | varies | varies | varies | — |
| Verified provider presets | ✓ (11 providers) | ✓ | — | — | — |
Comparison as of October 2026 — feature sets change; verify against the current pages before choosing. Competitor names belong to their owners.
Frequently asked questions
What is an SPF record?
An SPF (Sender Policy Framework, RFC 7208) record is a DNS TXT record that lists which mail servers are allowed to send email for your domain. Receiving servers check the sending IP against your SPF record; mail from unlisted servers fails the check. A typical record looks like: v=spf1 include:_spf.google.com ~all.
What is DKIM?
DKIM (DomainKeys Identified Mail, RFC 6376) adds a cryptographic signature to outgoing emails. Your mail server signs each message with a private key; receivers fetch the matching public key from a DNS TXT record at selector._domainkey.yourdomain and verify the signature, proving the message was not altered in transit.
What is DMARC?
DMARC (RFC 9989, formerly RFC 7489) builds on SPF and DKIM: it tells receiving servers what to do when a message fails authentication (none = just report, quarantine = spam folder, reject = bounce), and where to send aggregate reports (rua=). It also requires identifier alignment — the SPF or DKIM domain must match the visible From: domain.
Do I need SPF, DKIM, and DMARC — or is one enough?
Use all three. SPF alone breaks with forwarding; DKIM alone survives forwarding but states no policy; DMARC ties them together with alignment and an enforceable policy. Google and Yahoo's bulk-sender requirements effectively expect all three on sending domains.
What is the SPF 10 DNS lookup limit?
RFC 7208 §10.1 limits SPF evaluation to 10 DNS-querying mechanisms and modifiers (include, a, mx, ptr, exists, redirect). It bounds receiver workload and blunts DNS-based denial-of-service. ip4, ip6, and all do not count.
What happens if my SPF record exceeds 10 lookups?
The receiver aborts evaluation and returns PermError — SPF fails for your mail. Remove unused includes, replace includes with their IP ranges (SPF flattening), or move marketing mail to a subdomain. Count your record with the simulator above before publishing.
Can I publish two SPF records for one domain?
No — exactly one SPF record per domain. Two TXT records starting with v=spf1 cause a PermError. Merge new senders into the existing record instead.
SPF ~all vs -all: which ending should I use?
Start with ~all (softfail) while verifying every legitimate sender is listed. Once DMARC reports confirm nothing legitimate fails, switch to -all (hardfail). ?all states no policy; +all passes the entire internet and is almost always a misconfiguration.
What is a DKIM selector?
A selector lets a domain publish multiple DKIM keys at once (rotation, multiple senders). The public key lives at selector._domainkey.yourdomain — e.g. google._domainkey for Google Workspace, s1._domainkey for SendGrid. The signer names the selector in the DKIM-Signature header so verifiers know which record to fetch.
How do I add a DKIM TXT record longer than 255 characters?
A DNS TXT character-string holds at most 255 characters, but a record may contain multiple concatenated strings. Split long values (typical for 2048-bit keys) into quoted ≤255-char chunks — most DNS editors do this automatically, and this page provides a pre-split version.
Is it safe to generate DKIM keys in a browser tool?
Only if the tool is genuinely client-side. This generator uses your browser's WebCrypto API — the private key never leaves your device (confirm in DevTools' Network tab). Never use a generator that uploads the key to a server, and never publish the private key in DNS.
What DMARC policy should I start with?
p=none with rua=mailto:you@yourdomain: reports flow, delivery is unaffected. Monitor 2–4 weeks, fix every legitimate sender that fails alignment, then p=quarantine, then p=reject. Jumping straight to reject is the classic way to bounce legitimate mail.
DMARC none vs quarantine vs reject — what is the difference?
p=none takes no action but requests reports. p=quarantine treats failing mail as suspicious (usually spam folder). p=reject refuses it outright. Roll out in that order: none → quarantine → reject.
What changed in DMARCbis (RFC 9989)?
DMARCbis (RFC 9989, May 2026; reporting in RFC 9990/9991) made DMARC an IETF Standards Track protocol replacing RFC 7489. It removed pct, ri, rf; added np (policy for non-existent subdomains) and the binary t test-mode tag; and replaced the Public Suffix List with a DNS tree walk. Existing v=DMARC1 records remain valid.
What is the DMARC np tag?
np (new in RFC 9989) sets the policy for mail claiming a subdomain that does not exist in DNS at all (NXDOMAIN) — a popular spoofing route. np=reject blocks it even while your main policy is p=none. Verify your real sending subdomains resolve first.
Is pct still valid in DMARC records?
No — pct was removed by RFC 9989; receivers ignore it. For gradual rollouts use t=y (receivers apply policy one level milder) or run p=none with rua monitoring before enforcing.
How long do SPF, DKIM, and DMARC DNS changes take to propagate?
Usually minutes to a few hours depending on TTL and resolver caching; allow up to 24–48 hours to be safe. Use a low TTL (300s) while rolling out, then raise it.
Why do my emails still go to spam with SPF, DKIM, and DMARC set?
Authentication is necessary but not sufficient — placement also depends on reputation, engagement, content, and list hygiene. Check alignment first (the From: domain must match the SPF or DKIM domain), then read your DMARC aggregate reports for the receivers' actual verdicts.
How is this different from PowerDMARC, EasyDMARC, or MXToolbox generators?
Those are capable single-purpose tools, often funnels for paid platforms. This studio combines all three workflows on one page, runs 100% client-side with no signup, simulates the SPF 10-lookup limit, generates real RSA DKIM keys in your browser, and is DMARCbis-aware. Comparison as of October 2026 — verify current pages before choosing.
How do I verify my records are actually working?
After publishing and waiting for propagation: (1) query the records with dig/nslookup or a DNS checker; (2) send yourself a test email and inspect the Authentication-Results header — our Email Header Analyzer parses SPF, DKIM, and DMARC results from a pasted header; (3) watch your DMARC rua aggregate reports.